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Minutes Of the Board meeti n g held on February 17, 2015 in respect of 
RMB No.1/2015. 

The Board in its Meeting chaired by Shri Kaushal Srivastava,Chairman, 
CBEC deliberated on the issue detailed herein. The following off.cers were 

present. 

Ms. Joy Kumari Chander, Member (P&V) 

Shri S.B. Singh, Member (CX/ST/Comp/GST) 

Shri Najib Shah, DG(DGRI) & DGCEI 
Shri. P. K. Mohanty, DG(DGICCE) 

Shri Jayant Misra, DG(Systems) 

Shri Sandeep M. Bhatnagar, J.S.(Cus) 

Shri D.P. Dash, ADG(Systems) 

Shri Shashank Priya, Commr(GST) 

Shri S. M. Tata, Commr(ST) 

Shri Vivek Chaturvedi, ADG(Systems) 

Shri Upender Gupta, Addl Commr(GST) 

Ms° Hemambika R. Priya! Commissioner (Coord) & Secretary (CBEC) 

issue R in R b N rief 0 : l/ Data 5 Sharing Policy for CBEC - Sponsored by ADG 
(Systems) 

2 1 ADG(Systems) briefed the 8oard on the salient features of the proposed 
Data Sharing Policy/ CBEC has a rich repository of taxpayer data Pertaining to 
Customs Central Excise & Service Tax and there has been an increasing demand 
by several government departments / agencies/ research institutions to make this 
data available for purposes of analysis, and policy formulation. Presently the 
message exchanges between ICEGATE, DGFT and DGCIS are structured and well 
established However, adhoc requests were being regularly received from C&AG, 
crT DG Anti- Dumping etc. and hence, a need was felt to formulate a data 
sharing policy along with the protocol for exchange of data with other entities. As 
per toe proposed policy, data would be categorized into 3 categories which would 

be as follows: 


I ( l) SensitTve^ersonal Information (SPI) and Personally Identifiable Information 
(ii) Commercially sensitive information that has financial implications for a 
(Hi) DaTaXt comes into existence through 

(iv) Data pertaining to the configuration / technology of CBECs IT'syst 
(v Granular data pertaining to an individual's access / act.v.tyJogs £ the 
1 * system and such other forensic data which is available in CBEC 

(vi) Da'taTrovided to CBEC by another Government organisation in India or any 
other organization with whom CBEC has executed an MOU / NDA 

(vii) information/data received as per International Treaty Obligations 
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II. Sensitive 

Third party granular transactional data contained in individual import / export 
documents, returns, payments etc. would be treated as sensitive date having 
regard to its commercial sensitivity. 

III. Non-Sensitive Data 

Summarized or aggregated date created by combining information on individuals 
and legal entities would be considered as non-sensitive 

2.2 ADG (Systems) further informed that as per the protocol for exchange of 
highly sensitive data, it was proposed that the requesting agency such as C&AG, 
DGAD etc. which are mandated to receive the information would enter into a Moll 
with CBEC along with a Non-Disclosure Agreement. Thereafter, the information 
would be transferred through a Secure File Transfer Protocol mechanism i.e., 
server to server transfers of the information at regular intervals. This was also in 
line with ISO 27001/27002 requirements. As regards other adhoc requests for 
data, such data would be shared on the basis of specific requests and would be 
ordinarily provided over the official email in a template to the Single point of 
contact who would be nominated by the requesting Ministry/Department. 

2.3 The Board discussed the proposed policy for data sharing. Chairman 
queried whether other government departments had similar data sharing policy as 
was being contemplated by the CBEC. ADG(Systems) stated that the Department 
of Electronics and Information Technology(DelTy) had come out with the National 
Data Sharing and Accessibility Policy, and the proposed policy is in line with the 
National policy. D.G(DGRI) opined that the aim of the data sharing policy should 
be to facilitate sharing of data and not to restrict the same. DG(DGICCE) added 
that the data received under International Treaty/Agreements should also be 
classified as highly sensitive and similar protocol should be followed in respect of 
such data. JS(Cus) stated that such data had to be shared with Government 
agencies and Departments which are statutorily mandated to have this 
information. The procedure for such sharing with other Union Government 
departments/State Governments should only have a simple non-disclosure 
agreement. In this context, Commissioner (GST) suggested that as there was a 
structured mechanism to share aggregated data in Customs in the form of Daily 
Trade Reports, similar mechanism to share aggregated data relating to Central 
Excise and Service Tax with State VAT authorities needs to be put in place. It was 
further suggested that CBEC could examine the possibility to place such 
aggregated non-sensitive information on public domain, accessible to Research 
institutions and other similar agencies. 

2.4 Considering the suggestions received, the Board decided the following: 
There was a need for a data sharing policy laying down the broad parameters of 
the policy. Data should be categorized into two categories, namely, Sensitive and 
Non-Sensitive. Sensitive data would comprise the data elements proposed in 
Highly Sensitive and Sensitive categories and Non-sensitive data would consist of 
all aggregated data. The information/data received under International 
Treaty/Agreements should also be classified as Sensitive and similar protocol 
should be followed in respect of such data. The policy should envisage free flowing 
exchange of data sharing between Government's statutory authorities such as 
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DIRECTORATE GENERAL OF SYSTEMS & DATA MANAGEMENT 
CUSTOMS, CENTRAL EXCISE & SERVICE TAX 
4 th & 5 th FLOOR, HOTEL SAMRAT, 

XAUTILYA MARG, CHANAKYA PURI, 

NEW DELHI- 110 021 


F. No. IV(26)/41/2014- Systems- Part INew Delhi 

24.12.2014 

To, 

The Director General, 

Directorate General of Central Excise Intelligence 
New Delhi 


Sir, 


Subject: Draft Data Sharing Policy of CBEC : Correspondence regarding 

A presentation on the draft Data Sharing Policy of CBEC for exchange of data with external 
agencies within India was made to the Board on 24.12.2014. It has been decided by the 
Board that the draft Data Sharing Policy should be shared with the policy sections of CBEC/ 
some specific directorates for their comments/inputs on the draft. 

In this regard, please find enclosed the draft Data Sharing Policy of CBEC. You are kindly 
requested to send in your comments/inputs on the same to the Directorate of Systems latest 
by 02.01.2015, as the matter is to be discussed in the Board meeting thereafter. 

Enclosed : As above. 


. v-’ 



Yours Sincerely, 


a\^ 




(Vivek Chaturvedi) 
Commissioner, Systems. 
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Customs (ICES, ICEGATE), 
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(ACES) 

Data Warehouse 

DGCIS 
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CAG 

States 

Enquiry Commissions 

Research Institutes 

Board 
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Field Formations : 

DG Audit 
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DG Safeguards 

Commissionerates 

Mode of Data Sharing 

Recipients 


Uploaded on Departmental Websites 
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Secure File l ranster Protocol (SM M) - particularly in cases where 

the data file size is large and cannot be sent as simple mail 
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Internal Users, Other Govt. 
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Internal Users 

“ The list is indicative 
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4 t 4 Need for a clear approach to handle voluminous, growing data requests coming to DG 
(Systems) - Average 40 Requests per day 


National Data Sharing and Accessibility Policy (NDSAP) requires that the data 
generated using public funds should be classified into Shareable and Non-Shareable 
categories based on its sensitivity. Shareable data should be made available for 
Scientific, Economic and Developmental purposes 


CBEC has adopted ISO 27001 standard for Information Security in 2011; Revision of 
the standards in 2013 prescribes the following (Domain 13.2 - Information Transfer): 

■ Information Transfer Policies and Procedures 


Agreements on Information Transfer 
Electronic Messaging (Security) 
Confidentiality or Non Disclosure Agreements 
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Salient Features of Draft Data Sharing Policy - 1 


__• • '' '• • :j 


LB Scope and Applicability 

Policy for information exchange between CBEC and external agencies within India 
- Applicability to field formations and other directorates is to be decided by CBEC 

Data Categorisation 

Users’ Categorisation 


Request Categorisation and Modality of data sharing 

1 . Ad- hoc request based - Standard template and approval mechanism 


2. Structured exchange of identified data as per agreed frequency - MoU/ Formaif 
Agreement ** 


ill 
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Data under this category would ordinarily be exchanged through o secure electronic mechanism. In due 
course, it would be CBECs endeavour to secure such exchange through Digital Signatures whether personal 
or server level. 7 
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Salient Features of Draft Data Sharing Policy 


Jjjj Legal Framework 

Any organization/entity that receives data from CBEC under this policy assumes all 
legal liability arising out of any precipitative action taken by such organization/entity 
based on this data. 

3 Funding for Data Sharing 

CBEC reserves the right to levy such nominal fees as may be necessary to cover the 
costs of generating data in specific customised formats. 

[j§ Data Storage and Retention 

Highly Sensitive/Sensitive data provided by CBEC under this policy should be stored 
on a secure system whereby access is restricted to only authorised personnel. 
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Approval Sought from Board 

„ _ 



■ In Principle Approval for the draft Data Sharing Policy for External Entities within India 
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22 Dec 2014 16:43 


HP LASERJET FAX 


«//V- 

F.No. 296/2/2014-CX.9 (Pt.I) 

Government of India 
Ministry of Finance 
Department of Revenue 
Central Board of Excise & Customs 


New Delhi the 22 nd of December, 2014 

OFFICE 

Sub: Presentation regarding Providing Data to External Agencies 



Board has desired that a presentation be made before them on "Policy 
or Providing Data to External Agencies within India" on 24.12.2014 at 
10:45 a.m. in the chamber of Chairman, CBEC. 

2.. You are requested to kindly arrange for the said presentation. 


<8cL 

(Hemambika R. Priya) 

To Commissioner (Coord) 

DG(Systems) 

Copy for information to : 

1. Chairman, CBEC 

2. Member (P&V)/ L&J) 

3. Member (CX / Cus/ ST) 
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F.No, 296/2/2014-CX.9 (Pt.I) 
Government of Indie 
Ministry of Finance 

Department of Revenue 

Central Board of Excise & Customs 





New Delhi the 22 nd of December, 2014 

OFFICE MFMORANDUM 


Sub: Presentation regarding Providing Data to External Agencies 

Board has desired that a presentation be made before them on "Policy 
for Providing Data to External Agencies within India" on 24.12.2014 at 
10.45 a.m. in the chamber of Chairman, CBEC. 

2.. You are requested to kindly arrange for the said presentation. 


(Hemambika R. Priya) 

To Commissioner (Coord) 

DG(Systems) 

Copy for information to : 

1. Chairman, CBEC 

2. Member (P&V)/ L8J) 

3. Member (CX / Cus/ST) 
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BRIEF FOR THE BOARD MEETING ON DATA SHARING POLICY FOR CBEC 

The Directorate of Systems (DoS) has a rich repository of taxpayer data pertaining to 
Customs, Central Excise & Service Tax residing in its business applications and also in 
the Enterprise Data Warehouse (EDW). DoS receives regular requests for data from 
internal and external agencies. Currently, data is being shared with the internal and 
external agencies within India, in different ways and modalities. While some exchanges 
are structured and well established, most of the others are in the nature of ad-hoc 
requests and there is a need to bring structure and rigour to the process for entertaining 
requests for data and providing such data. Data requests from the external users have 
also been increasing at a significantly steady rate. In addition, since 2011 CBEC has 
adopted the ISO 27001 standard for information security for which it is audited every 
year for compliance. This standard which has been revised in 2013 has a specific 
domain of communications security where stringent guidelines have been laid down for 
Information Transfer within an organization to an external agency. 

Further, one of the action points to emerge out of the meeting held on 11.03.2014 under 
the chairmanship of the Chairman, CBEC to discuss the role & functions of the exclusive 
Audit Commissionerates proposed to be set up in the cadre restructuring was for 
DG(Systems) to prepare and forward a draft Data Sharing Policy to the Board for its 
consideration. 

All the above made it imperative for CBEC to formulate a Data Sharing Policy. 

A draft Data Sharing Policy was prepared and shared with all the teams within the 
Directorate of Systems for their inputs on 03.07.2014. Based on the inputs received 
together with the National Data Sharing and Accessibility Policy (NDSAP) and ISO/IEC 
27001:2013 & 27002 document on implementation guidelines & standard of Information 
Security, a draft Data Sharing Policy has been prepared for the Board’s consideration. 
The Data Sharing Policy aims to define the approach and process to be followed by the 
DoS for dealing with requests for data by external agencies within India. 

The key aspects entailed in the Data Sharing Policy include: 

a. Scope and Applicability : The scope of this Data Sharing Policy extends to the 
information exchange between DoS, CBEC and external agencies within India. 





b. Da ta Cateqorisation : On the basis of its sensitivity, granularity, criticality and 
ownership/data origination and considering the data categorisation as prescribed in 
NDSAP, the Data Sharing Policy proposes to classify data into Highly Sensitive, 
Sensitive and Non-Sensitive categories. 

c. Us er Cateqorisation : Users of the data are proposed to be categorised on the basis 
of the agencies/external bodies that are empowered by a statue to ask for data, other 
government agencies such as the state government departments, investigative 
agencies outside CBEC etc and research organisations, commissions, etc who 
utilise the data for their research purposes. 

Request Cateqorisation and Modality o f data sharing : Given the criticality of the data 
being shared, it is proposed to device two modalities of sharing the data i.e. Ad-hoc 
request based and Structured periodic exchange of identified data fields which will 
be governed by MoU/ Formal Agreements. 


e. L egal Framework : The agency that receives data from CBEC shall use the data only 

for the explicitly agreed purpose and there will be no unlawful disclosures or loss of 
the same. 

f - fu nding for Data Sharing : In the present scenario, CBEC is not charging anything for 
sharing its data, however, it reserves the right to levy the necessary charge required 
to generate the desired data in the desired customized formats. 

9 D ata Storaqe and Retention : Data will be stored by the Requesting party on a secure 
system password protected whereby access to the data is restricted to only those 
who are named within this Framework. 

Decisions to be taken by the CBEC 

a. The Board may approve the draft Data Sharing Policy for sharing of data with 
External Agencies within India. 
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Data Sharing Present Scenario 


Data Source 


External Recipients 


Customs (ICES, ICEGATE), 

Central Excise & Service Tax 
(ACES) 

Data Warehouse 


DGCIS 

DGFT 

CAG 

States 

Enquiry Commissions 
Research Institutes 


Internal Recipients 


Board 

TRU 

Field Formations : 

DG Audit 

DRI 

DGCEI 

DG Safeguards 
Commissionerates 


Mode of Data Sharing 

Uploaded on Departmental Websites 

Official or government email ids 

Secure File Transfer Protocol (SFTP) - particularly in cases where 
the data file size is large and cannot be sent as simple mail 
attachments 


Statistical, Analytical and MIS Reports 

- The list is indicative . 
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Need for a clear approach to handle voluminous, growing data requests coming to DG 
(Systems) - Average 40 Requests per day 


♦♦♦ National Data Sharing and Accessibility Policy (NDSAP) requires that the data 
generated using public funds should be classified into Shareable and Non-Shareable 
categories based on its sensitivity. Shareable data should be made available for 
Scientific, Economic and Developmental purposes 

♦♦♦ CBEC has adopted ISO 27001 standard for Information Security in 2011; Revision of 
the standards in 2013 prescribes the following (Domain 13.2 - Information Transfer): 

■ Information Transfer Policies and Procedures 

■ Agreements on Information Transfer 

■ Electronic Messaging (Security) 

■ Confidentiality or Non Disclosure Agreements 
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Salient Features of Draft Data Sharing Policy 


ijJ Scope and Applicability 

- Policy for information exchange between CBEC and external agencies within India 

- Applicability to field formations and other directorates is to be decided by CBEC 


'jj Data Categorisation 


i.|j Users’ Categorisation 


igl Request Categorisation and Modality of data sharing 

1. Ad- hoc request based - Standard template and approval mechanism 

2. Structured exchange of identified data as per agreed frequency - MoU/ Formal 
Agreement ** 
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Data under this category would ordinarily be exchanged through a secure electronic mechanism. In due 
course, it would be CBEC's endeavour to secure such exchange through Digital Signatures whether personal 
or server level. 


Salient Features of Draft Data Sharing Policy - 2 


D Legal Framework 

Any organization/entity that receives data from CBEC under this policy assumes all 
legal liability arising out of any precipitative action taken by such organization/entity 

based on this data. 

1 ^ Funding for Data Sharing 

CBEC reserves the right to levy such nominal fees as may be necessary to cover the 
costs of generating data in specific customised formats. 

Data Storage and Retention 

Highly Sensitive/Sensitive data provided by CBEC under this policy should be stored 
on a secure system whereby access is restricted to only authorised personnel. 
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Approval Sought from Board 


In Principle Approval for the draft Data Sharing Policy for External Entities within India 
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The draft Data Sharing Policy aims to define the approach and process to be followed by 
the Directorate of Systems for dealing with requests for data by external entities withm In*., 
in alignment with National Data Sharing and Accessibility Policy (NDSAP), in comp ,an« 
with the information Security standards prescribed by the ISO 27001 (as rev, ed n 2 13, 
and also in view of the consistently increasing demands for data from externa, ant,ties. 


The kev aspects entailed in this policy include: 


(i) scope and Applicability! The scope of this data sharing policy extends to the 
information exchange between Directorate of Systems. CBEC and externa, 

agencies within India. 


categorisation: On the basis of its sensitivity, granularity, criticality and 
ownership/data origination and considering the data categorisation as prescribed ,n 
NDSAP, the Data Sharing Policy proposes to classify data into Highly Sensitive, 

Sensitive and Non- Sensitive categories. 


„ car Ca ,ea 0ri sation: Users of the data are proposed to be categorised on the basis 
of the agencies/external bodies that are empowered by a statute to ask for a a, 
other government agencies such as the state government departments, 
investigative agencies outside CBEC etc and Research organisations, commissions 
etc who utilise the data for their research purposes. 

(jv) Categorisation — Mndaiitv of data sharing: Given the criticality of the data 

being shared, it is proposed to device two modalities of sharing the data .... Ad-hoc 
request based and Structured periodic exchange of identified data fields which will 

be governed by Moll/Formal Agreements. 

(v) Framework: The entity that receives data from CBEC shall use the data only 

for the explicitly agreed purpose and there will be no unlawful disclosure or loss of 

the same. 
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(vi) Funding for Data Sharing: In the present scenario, CBEC is not charging anything 
for sharing its data, however, it reserves the right to levy the necessary charge 
required to generate the desired data in the desired customised formats. 

(vii) Data Storage and Retention: Data will be stored by the Requesting party on a 
secure system password protected whereby access to the data is restricted to only 
those who are named within this Framework. 
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Central Board of Excise and Customs 


1. Introduction 

Data is universally recognized as a valuable resource that should be maintained in a 
manner which ensures that its potential value is optimally realized. Most data today 
is maintained and exchanged electronically, which has increased the ease of 
exchange of data and at the same time increased the need for a structured and 
secure mechanism for such an exchange. India's National Data Sharing and 
Accessibility Policy (NDSAP) states inter alia that the principles on which data sharing 
and accessibility need to be based include: Openness, Flexibility, Transparency, 
Protection of Intellectual Property, Formal responsibility, Professionalism, 
Interoperability, Quality, Security, Efficiency, Accountability, Sustainability and 
Privacy. There is a large quantum of data generated at the cost of public funds by 
various organizations and institutions in the country and this data can be used for 
scientific, economic and developmental purposes. 

2. Need for Data Sharing Policy 
2.1 Current Status 

The Central Board of Excise and Customs (CBEC) has a rich repository of taxpayer 
data pertaining to Customs, Central Excise and Service Tax. The Directorate of 
Systems (DoS), CBEC holds this data in its IT syste ms in a Custodial capaci ty. Online 
transactional data pertaining to Customs, Central Excise and Service Tax resides in 
the respective business applications, namely, ICES, ACES, ICEGATE, etc. The 
centralization of its consolidated IT Infrastructure has also enabled CBEC to create an 
Enterprise Data Warehouse (EDW) which is also actively being used to address the 
data requests of both internal and external agencies. 

There has been an increasing demand by several external agencies that the data 
which is collected with the deployment of public funds should be made readily 
available to all for enabling rational debate, better decision-making, policy 
formulation and use in meeting civil society needs. 

Currently, data is being shared with multiple internal and external agencies within 
India, in different ways and modalities. CBEC's ICEGATE application serves as ihe 
interface for providing Customs transactional data to agencies such as DGFT, DGCIS, 


Internal 
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Data Sharing policy V 0.1 


Central Board of Excise and Customs 


RBI, etc. Data from the Enterprise Data Warehouse is being increasingly used for 
answering Parliament questions and for framing responses to applications received 
under the Right to Information (RTI) Act. The details of such exchange with external 
and internal agencies within India are tabulated at Annex-A and Annex-B 


respectively. 


Data to external entities is shared using either of the following modes: 



1. On official or government email ids 


2. Secure file transfer protocol (SFTP) - particularly in cases where the data file 
size is large and cannot be sent as simple mail attachments 

3. Over Virtual Private Network (VPN) to identified trusted external users for 


pre-agreed reports 


2.2 Need for Policy 


CBEC holds indirect tax data in a Custodial capacity. As discussed above, the data 
requests from the external users have increased very significantly. In addition, since 
2011 CBEC has adopted the ISO 27001 standard for information security for which it 
is audited every year by Standards Testing Quality and Certifications, a body under 
the Ministry of Information and Communication Technology (MICT) for compliance. 
This standard which has been revised in 2013 has a specific domain of 
communications security where stringent guidelines have been laid down for 
Information Transfer within an organ ization and with any external entity. The 
relevant extract is placed at Annex-C. 

This needs to be seen in the context of increasing demands for data in view of 
increasing awareness of the value and benefits that such data brings, which include: 

1. Maximising use of Government's data for the benefit of stakeholders 

2. Improving policy making across government 

3. Supporting research by various government bodies/ research agencies 

4. Detection of potential frauds 

5. Non-intrusive profiling of taxpayers 
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Central Board of Excise and Customs 


Also, while some exchanges, such as those between ICEGATE and DGFT & DGCIS are 
structured and well established, most of the others are in the nature of ad-hoc 
requests and there is a need to bring structure and rigour to the process for 
entertaining requests for data and providing such data. 


AH the above make it imperative for CBEC to formulate a Data Sharing policy along 
with a protocol for exchange of data with external entities within India. In course of 
time, a similar protocol for exchange of data with external entities outside India may 
also have to be established. 

The key aspects to be covered in the data sharing policy include. 

- Scope and Applicability 

- Data Categorisation 

- User Categorisation 

- Request Categorisation and Modality of data sharing 
Legal Framework 

- Funding for Data Sharing 

- Data Storage and Retention 

2.3 Scope and Applicability 

This document lays down the policy governing information exchange between 
CBEC and external agencies within India. 

As regards data exchange with external agencies outside India, subject to 
approval from the competent authority with duly identified data content, the 
same shall be governed by a separate self contained document CBEC's IT 
Connectivity Protocol with Foreign Entities. 


While the applicability of this policy is primarily focused on the Directorate of 
Systems, CBEC (since most data is exchanged electronically), its applicability 
to CBECs field offices and other Directorates would also need to be laid down, 
especially in view of Trade bodies' concerns regarding availability of sensitive 
commercial data in public domain. 
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3. Data Categorisation 



The data available with CBEC is categorised for shareability based upon its 
sensitivity, granularity, criticality and ownership/data origination. In line with the 
categorization of data prescribed in NDSAP, data is then classified as Shareable and 
Non-shareable. As can be seen from the diagram above, CBEC data elements have 
been categorised as Highly Sensitive, Sensitive and Non-Sensitive. Hi ghly Sensitive 
data would not normally be shareable. In exceptional circumstances, CBEC reserves 
the discretion to approve the request for such data and also to specify the nature 
and modality of its shareability. Normally, organisations seeking sensitive data would 
be required to enter into a formal MoU or agreement with CBEC which would contain 
these controls as well as non-disclosure requirements as applicable. 

3.1 Highly Sensitive 

The following categories of data shall be treated as Highly Sensitive. 

3.1.1. Sensitive Personal Information (SPI) and Personally 
Identifiable Information (PII): As per the Information Technology 
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Act 2000 (as amended in 2008), Sensitive Personal Information (SPI) 
and Personally Identifiable Information (PII) data is Highly Sensitive. 
All data pertaining to an individual entity shall therefore be classified 
as Highly Sensitive 

3.1.2. Commercially sensitive information that has financial 
implications for a taxpayer: Data which if compromised, can cause 
economic impact to a taxpaying entity such as invoice details, pricing 
information, supplier details, etc shall be classified as highly sensitive. 

3.1.3. Data that comes into existence through enforcement functions 
of CBEC: Data generated as part of internal analysis using CBECs 
internal tools and techniques for profiling as part of Enforcement 
functions, Risk Analysis, Investigations and Intelligence gathering etc 
shall be considered as Highly Sensitive. This includes data contained in 
DRIPS, Offence data, RMS Interdiction details. 

3.1.4. Data pertaining to the configuration/technology of CBEC s IT 
systems 

3.1.5. Granular data pertaining to an individual s access/activity logs 
in the system and such other forensic data which is available in 
CBEC's IT systems 

3.1.6. Data provided to CBEC by another Government organisation in India or 
any other organization with whom CBEC has executed an MoU/NDA. 
Provided that where such data has been or is being received as part of 
an existing arrangement (eg IEC data from DGFT), such data will fall in 
the Sensitive category. 

The data elements (for 3.1.1 and 3.1.2) from various source systems is 

listed at Annex-E. 
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3.2 Sensitive 

Third party granular transactional data contained in individual import/export 
documents, returns, payments etc shall ordinarily be treated as Sensitive data, 
having regard to its commercial sensitivity. Thus, while the granularity of information 
contained in such a data may not enable a direct identification of a Commercial 
entity, yet such data could be related to manufacture of specific commodities in a 
particular area, or the valuation trends of a commodity imported from a particular 
country of origin- the information contained herein would still be sensitive from a 
perspective of commodity level profiling of imports as well as domestic production. 

The data elements from CBEC source systems falling under this category are 
listed at Annex-E. 

3.3 Non-Sensitive Data 

Highly summarized or aggregated data created by combining information on 
individuals and legal entities shall be considered as Non-Sensitive. Data which is 
mandated by Statute, other Acts in force and/or policy decisions by the Board to be 
publically displayed or openly hosted on CBEC website/s shall be treated as falling 
into this category. 


Data which is placed on CBEC's website in compliance with the RTI Act and long 
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4. User Categorisation 



The diagram above depicts the categorisation of requestors of data from CBEC. 
There are broadly three categories as under: 

4.1 Statutorily Mandated 

This category includes agencies or bodies empowered by Statute to ask for 
data such as Parliamentary Committees, the Comptroller & Auditor General of 
India and offices there under (eg CERA) and applicants under the ambit of the 
Right to Information Act. Requests under this category would be accorded the 
highest priority and dealt with accordingly. Data falling under the Highly 
Sensitive category shall ordinarily be provided against a specific authorized 
request on a case to case basis. For regular/periodic requests for data, CBEC 
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may at Its discretion reddest the organisation to enter into an 
MoU/Agreement (Annex-I) for such data 

4 2 Other Government Agencies 

This category would cover other Government agencies/bodies sue as 
National Security Agencies, Investigating Agencies outside CBEC, ot er 
ministries and departments, State Government departments ~ 
under the Highly Sensitive category shall not ordinarily beprovi e . ' 

CBEC would need ti tike a Sit* by'SisiTapproach injhe event that data 
classified as Highi7sensitive is sought by such agencies. Sensitive data may 
•be provided iiiiSStTipeciflc authorized request on a case to case basis, o 
regular/periodic requests for data, CBEC would require the organisation o 
enter into an MoU/Agreement (Annex-I) for such data. In the event that sue 
an organisation seeks Highly Sensitive data on a one-time basis, CBEC may at 
its discretion accede to such a request. 

4 3 Research Organisations, Commissions etc 

This category would cover requests from academic and research institutions 
such as National Council of Applied Economic Research (NCAER), Nations 
institute of Public Finance and Policy (NIPFP), Indian Institutes of 
Management (IIMs) and Indian Institutes of Technology (IITs) etc. It would 
cover requests from specially set up Commissions or Task Forces etc. 
Requests from such organisations would ordinarily be entertained for non¬ 
sensitive data only. In the event that a specially set up Commission/Task 
Force seeks Highly Sensitive/Sensitive data, CBEC would examine each 
request on its own merit and decide whether such data can be provided. In 
addition, such requests would be taken up only after pending requests under 
the priority category have been dealt with. 


5. Request Categorisation and Modality of Data Sharing 

Data sharing modality would depend upon the data categorization and data volume. 

Data requests would be categorised into, 
i. Ad- hoc request based 
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ii. structured periodic exchange of identified data. 

5.1 Ad-hoc Request-Based 

Under this category, data will he shared oh the oasis of a specific reguest or e 
same It would cover requests which seek a limited amouht of data for P 
entity and Is related to an organisational requirement, an investigation orjnqu.ry 
requests wil, he entertained only when sent in the prescribed template (Annex- G>. 
This template would be available on CBEC's website a ww.cbec.qov jp 

in case the data pertains to an investigation/inquiry being conducted by a law 
enforcement agency, CBEC may consider providing such data to a person du y 

authorised by the said agency. 

,n each such case where this request is fulfilled by the Directorate of Systems, the 
data shall be provided only with the approval of Director General (Systems), 

,n such cases data shall ordinarily be provided over requestor's official e-mail in 
response to the data request template at Annex- G received either over e-ma„ or 
Irably in hard copy. In case it is fouhd that the e-mai, so received has not com 
rom a proper domain or is detected to be a malicious e-mail, CBEC reserves 
right to take such action including forensic investigation by third Pa*y’ ‘ 

/or legal remedy, as may be required. If malicious intent is established, 
discretion may choose not to provide any further data to the said entity 


5.2 Structured Exchange of Identified Data 

This category would pertain to data required to be exchanged in agreed structured 
formats at a defined frequency, including bulk data sharing. 

Organisations seeking data under this category would be required to execute a 
forma, MoU/Agreement which will govern this sharing of data. Add,bona y V 

would be required to nominate a nodal officer and an alternate nodal o.f,c 
would be the authorized contact person for data transmission and common,cat, 

related to the same. 
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Data under this category would ordinarily be exchanged through a secure electronic 
mechanism. In due course, it would be CBEC's endeavour to secure such exchange 
through Digital Signatures whether personal or server level. 

6. Legal Framework 

Any organization/entity that receives data from CBEC under this policy assumes all 
legal liability arising out of any precipitative action taken by such organization/entity 
based on this data. 

7. Funding For Data Sharing 

CBEC reserves the right to levy such nominal fees as may be necessary to cover the 
costs of generating data in specific customised formats. Such levies would be 
determined after due approval process from the Competent Authority and as per 
applicable Government policies. Currently CBEC is not charging anything for 
providing data, regardless of its complexity or size. 


8. Data Storage and Retention 

Highly Sensitive/Sensitive data provided by CBEC under this policy should be stored 
on a secure system whereby access is restricted to only authorised personnel. The 
data should be retained only until it has served the purpose for which it was obtained 
and securely erased thereafter. Any/all liability arising out of disclosure of such data 
shall lie solely with the requesting organisation. 
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11. Annex C- ISO 27001/27002 

Domain 13 of ISO/IEC 27001:2013 & 27002 (Implementation Guidelines) 

13 Communications Security 

13.1 Network Security Management 

13.2 Information transfer 


Objective: To maintain the security of information transferred within an 
organization and with any external entity. 


13.2.1 Information transfer policies and procedures 

Control 

implementation gu idance 

The procedures and control to be followed when using communication facilities for 

fr ° m 

b) ^r^amst —- 

transmitted though the use of electronic communication (see 12. . 

c) procedures for pmtecting communicated sensitive electronic information that 

is in the form of an attachment; . .. f , ri iit-ipq (c ee 

d) policy or guidelines outlining acceptable use of communication facilities (sse 

el SSLl external party and other user’s responsibilities not to compromise 
’ thT organization, eg. through defamation, harassment, impersonation, 
forwarding of chain letters, unauthorized purchasing etc., 

„ use o^^ptogmphic techniques e.g. to protect the confidentiality, integrity 

anrl authenticity of informstion (see Clsuse 10) t. 
o) retention and disposal guidelines for all business correspondence '"eluding 
9) messages, in accordance with relevant national and local legislation and 

h) mntrol'and restriction associated with using communication facilities, e.g. 
automatic forwarding of electronic mail to external mail addresses, 

i) advising personnel to take appropriate precautions not to revea, confident 

information; 
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i) not leaving messages containing confidential information on answering 
machines since these may be replayed by unauthorized persons, stored on 
communal systems or stored incorrectly as a result of misdialing; 
k) advising personnel about the problems of using facsimile machines or 

services, namely : 

1) unauthorized access to built-in message stores to retrieve messages; 

2) deliberate or accidental programming of machines to send message to 
specific numbers, 

3) sending documents and messages to the wrong number either by 
misdialing or using the wrong stored number. 

In addition, personnel should be reminded that they should not have confidential 
conversation in public places or over insecure communication channels, open offices 
and meeting places. 

Information transfer services should comply with any relevant legal reguirements 
(see 18.1). 

Other information 

Information transfer may occur through the use of a number of different types of 
communication facilities, including electronic mail, voice facsimile and video. 

Software transfer may occur through a number of different mediums, including 
downloading from the Internet and acquisition from vendors selling off-the-shelf 

products. 

The business legal and security implication associated with electronic data 
interchange, electronic commerce and electronic communications and t e 
requirements for controls should be considered. 

13.2.2 Agreements on information transfer 

Control 

Agreement should address the secure transfer of business information between the 
organization and external parties. 

Implementation guidance 

Information transfer agreement should incorporate the following: 

a) management responsibilities for controlling and notifying transmission, 
dispatch and receipt; 

b) procedures to ensure traceability and non-repudiation; 

c) minimum technical standards for packaging and transmission, 

d) escrow agreements; 
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e) 

f) 

g) 


h) 

0 

j) 

k) 


courier identification standards; 

responsibilities and liabilities in the event of information security incidents, 
such a loss of data; 

use of an agreed labeling system for sensitive or critical information, ensuring 
that the meaning of the labels is immediately understood and that the 
information is appropriately protected (see 8.2'); 

technical standards for recording and reading information and software; 
any special controls that are required to protect sensitive items, such as 
cryptography (see Clause 10); 

maintaining of chain of custody for information while in transit; 
acceptable levels of access control. 


Policies, procedures and standards should be established and maintained to protect 
information and physical media in transit (see 8.3.3) . and should be referenced in 
such transfer agreements. 

The information security content of any agreement should reflect the sensitivity of 
the business information involved. 

Other Information. 

Agreements may be electronic or manual, and may take the form of formal 
contracts. For confidential information, the specific mechanisms used for the transfer 
of such information should be consistent for all organization and types of 
agreements. 

13.2.3 Electronic messaging 

Control 

Information involved in electronic messaging should be appropriately protected. 
Implementation guidance 

Information security considerations for electronic messaging should include in 
following: 

a) protecting message from messages from unauthorized access, modification or 
denial of services commensurate with the classification scheme adopted by 
the organization; 

b) ensuring correct addressing and transportation of the message; 

c) reliability and availability of the services; 

d) legal considerations, for example requirements for electronic signatures; 

e) obtaining approval prior to using external public services such as instant 
messaging, social networking or file sharing; 

f) Stronger levels of authentication controlling access from publicly accessible 
networks. 
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b) expected°du ration of an agreement, including cases where confidentiality 
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information disclosures; intellectual property, and 
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„ or destroyed at agreements 

w e" actions to be taken in case of a breach of the agreement. 
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« be reviewed 
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responsible and authorized manner. 


f) 

g) 

h) 


Page 25 of 49 


Internal 
























Data Sharing policy V 0.1 


Central Board of Excise and Customs 


There may be need for an organization to use different forms of confidentiality or 
non-disclosure agreements in different circumstances. 
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12. Annex D- IT Connectivity Protocols 
Establishing Data Exchange 

Table below provides requirements towards enabling electronic data 

exchange with CBEC: 


S.No 

Parameter 

Modality 

1 

Connectivity 

• No direct connectivity to CBEC's production servers 

shall be allowed to any international partner. 

• Message exchange would take place through placing 
of files in designated directories (separate Inbound & 
Outbound), with specific permissions 

2 

Network 

Connectivity 

The default mode for establishing communication shall 

be over Site-to-Site SSL VPN 

3 

Static IP Address 

Only authorized devices with declared static IP address/ 

Mac address shall be allowed access 

4 

Network Port for 

incoming data 

Only specified port shall be allowed for communication 

5 

Authentication 

• Digital signature based authentication using Class III 
digital certificates 

. TACACS/CHAP 

6 

Encryption 

ISAKMP (Internet Security Association and Key 

Management Protocol);AES;AS2;SHA 

7 

File type 

Text file and XML formats 

8 

Max File Size 

• Only one file shall be accepted for each transaction 

• The maximum permissible size of such file shall be 

10KB 

9 

Hash Function 

Hashing shall be implemented to check integrity of the 

files being exchanged - SHA 

10 

Non-Disclosure 

and or Acceptable 

Use Agreement 

An agency connecting to CBEC's IT Systems will 

execute a mutually agreed agreement for non¬ 
disclosure and/or acceptable use of CBEC's data, 
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S.No 

Parameter 

Modality 



including its storage and archival. 

11 

Audit Logs 

Audit logs will be created for each transaction and user 

activity. These may be subject to third party audits 

commissioned by CBEC. 

12 

Other 

Tools that do not support logging or establishing 
forensic trails (including but not limited to Winscp) shall 

not be used by either party. 


Communication Server: CBEC shall create separate Inbound and Outbound 
directories on its communication server; the files sought to be sent to the 
International partner shall be placed in the outbound directory by CBEC. Similarly the 
files sought to be received from the International partner shall be placed in the 
inbound folder by the International partner. 

Data Purging / Archival: Once a file has been successfully picked up from the 
inbound directory by CBEC's IT Systems, it will be purged within an agreed 
timeframe not later than 7 days. 

Communication Channel: It is important that both parties maintain clear lines of 
communication and towards this objective, both parties shall provide to each other 
the contact details of the Officer(s) In-charge of the data exchange, including the 
emergency contact details. Instance/s of planned and un-planned downtime shall be 
communicated to the other party. 

Incident Response Protocol: Both the parties shall notify each other of intrusions, 
attacks, or misuse of data. In the case of a security breach, both parties shall 
coordinate their incident response activities. 

Change Management 

In the event of any updates to CBEC's IT Security policy and procedures, the 
corresponding update in the data exchange protocol shall be notified to the 
International partner. Thereafter, the updated protocol shall be treated as a 
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mandatory requirement for the data exchange between CBEC and the International 
partner. 

Discontinuing the Data Exchange 

Planned discontinuation: In case discontinuation of the data exchange is 
warranted, the initiating party shall notify the other party in writing, and it 
shall in turn receive an acknowledgment for the same. The notification should 
describe the reason/s for the disconnection and provide the timeline for the 
disconnection 

“ Emergency discontinuation: If one or both parties detect an attack or any 
other contingency that exploits or jeopardizes the IT systems or data, data 
exchange can be terminated without providing a prior written notice to the 
other party. However, if such an action is warranted, the same shall be 
notified to the other party at the earliest thereafter. 

Any of above requirements can be modified through the approval of the Chief 

Information Security Officer (CISO) of CBEC 
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13. Annex E- Data Elements for Highly Sensitive and Sensitive 


Data 


Classification of ICES Data Tables 


S 

No 

Table Name 

Data Description 

Classification of 
Data (Tentative) 

1 

C SB 

table contains all master details in Exports 

Highly Sensitive 

2 

C AR4 

table contains str certification details in Exports 

Highly Sensitive 

3 

C_DBK 

table contains all dbk value and qty details in 
Exports --- 

Highly Sensitive 

4 

C_DBK_DIFF 

table contains all dbk value and qty details in 
Exports - 

Highly Sensitive 

5 

C_DBK_SUGG 

table contains all dbk value and qty details in 
Exports 

Highly Sensitive 

6 

C_DEEC 

table contains all deec license and value and 

qty details in Exports 

Highly Sensitive 

7 

C_DEPB 

table contains all depb license and value and 

qtv details in Exports 

Highly Sensitive 

8 

C_DEPB_LIC 

table contains all depb license and value and 

atv details in Exports 

Highly Sensitive 

9 

C_DEPB_PAREN 

T 

table contains all depb license and value and 

atv details in Exports -- 

Highly Sensitive 

10 

C_DFRC 

table contains all dfrc license and value and 

qtv details in Exports 

Highly Sensitive 

11 

C_EOU_REP 

table contains EOU exports details and iec 
details in Exports - 

Highly Sensitive 

12 

C INVOICE 

table contains all invoice details in Exports 

Highly Sensitive 

13 

C ITEM NOTES 

table contains all item notes details in Exports 

Highly Sensitive 

14 

C_ITEM_RATE 

table contains all item wise rate details in 
Exports 

Highly Sensitive 

15 

C_ITEM_RAW_M 

TRL 

table contains all raw material items details in 

Exports 

Highly Sensitive 

16 

CJTEMS 

table contains all item value and rate details in 
Exports 

Highly Sensitive 

17 

BE MAIN 

table contains all master details in Imports 

Highly Sensitive 

18 

BE INV 

table contains all invoice details in Imports 

Highly Sensitive 

19 

BE_ITEM_DET 

table contains all item value and rate details in 

imports 

Highly Sensitive 

20 

BE_ITEM_DUTY 

FG 

table contains all item value and fg duty details 
in imports 

Highly Sensitive 

21 

BE_A_ITEM_DE 

T 

table contains all item value and rate details in 

imports - 

Highly Sensitive 

22 

BE_DEPB 

table contains all depb license and value and 
qtv details in Imports 

Highly Sensitive 

23 

BE_A_DEPB 

table contains all depb license and value and 

atv details in Imports 

Highly Sensitive 

24 

BE_AMEND 

table contains only amendment details in 
Exports 

Highly Sensitive 

25 

BE IGMS 

table contains all igm details in Imports 

Highly Sensitive 

27 

BE_ITEM_RSP 

table contains all item value,rate and rsp 

details in imports 

Highly Sensitive 
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Classification of ICES Data Tables 

s 

No 

Table Name 

Data Description 

Classification of 

Data (Tentative) 

28 

BE_LIC 

table contains all license and value and qty 
details in Imports 

Highly Sensitive 

29 

BE_REIMPORT 

table contains all master details for re imports 
goods in Imports 

Highly Sensitive 

30 

A_BE_MAIN 

table contains all amend master details in 
Imports 

Highly Sensitive 

31 

A_BE_INV 

table contains all amend invoice details in 
Imports 

Highly Sensitive 

32 

A BE_ITEM_DE 

T 

table contains all amend item value and rate 
details in imports 

Highly Sensitive 

33 

A BE ITEM_RS 

P 

table contains all amend item value, rate and 
rsp details in imports 

Highly Sensitive 

34 

A_BE_DEPB 

table contains all amend depb license and 
value and qty details in Imports 

Highly Sensitive 

35 

A_BE_REIMPOR 

T 

table contains all amend master details for re 
imports goods in Imports 

Highly Sensitive 

36 

A_BE_LIC 

table contains all amend license and value and 
qty details in Imports 

Highly Sensitive 

37 

DE SENSITIVE. 
PORT 

Details of Ports which are sensitive 

Highly Sensitive 

38 

C SB STAT 

table contains only status and flag in Exports 

Sensitive 

39 

C_CESS 

table contains cess value and certification 
details in Exports 

Sensitive 

40 

C.CONTAINER 

table contains only container and package 
details in Exports 

Sensitive 

41 

C_DEPT_COMT 

table contains only departmental comment and 
flaq in Exports 

Sensitive 

42 

C_EXAM_REP 

table contains only examination reports and 
flaq details in Exports 

Sensitive 

43 

C_EXCHANGE 

table contains only exchange rate details in 
Exports 

Sensitive 

44 

C_GOODS_REG 

D 

table contains goods registration details in 
Exports 

Sensitive 

45 

C_JOB_WORK 

table contains only some comment of job in 
Exports 

Sensitive 

46 

C_QUOTA 

table contains allocate quota detailsfissue date 
.agency name etc) of job in Exports 

Sensitive 

47 

C THIRD PART 

Y 

table contains only iec third party details in 
Exports 

Sensitive 

48 

C_VOYAGE 

table contains only shipping line in Exports 

Sensitive 

49 

BE_BOND 

table contains all bond and bg details in 
Imports 

Sensitive 

50 

BE.CASH 

table contains all duty details in Imports 

Sensitive 

52 

BE.CEX 

table contains all customs certification in 
Imports 

Sensitive 

53 

BE.CONT 

table contains only container details in Imports 

Sensitive 

54 

BE EXAM.INST 

R 

table contains only examination reports and 
flag details in Imports 

Sensitive 

55 

BE.EXCHANGE 

table contains only exchange rate details in 
Imports 

Sensitive 


Internal 


Page 31 of 49 









































Data Sharing policy V 0.1 


Central Board of Excise and Customs 


Classification of ICES Data Tables 

s 

No 

Table Name 

1 dUlw 1^1 Ql IIC 

Data Description 

Classification of 

Data (Tentative) 

56 

BE_FINE 

table contains only fine rate details in Imports 

Sensitive 

57 

BE_GOOD_EXA 

M 

table contains goods registration details in 
Imports 

Sensitive 

58 

BE HSS 

table contains only iec hss details in Imports 

Sensitive 

59 

BE_MISC_CH 

table contains only misc value, qty and date 
details in Imports 

Sensitive 

60 

BEJWMNT 

table contains only movement in Imports 

Sensitive 

61 

BE_PERM 

table contains only perm code and office id and 
date details in Imports 

Sensitive 

62 

BE QRY REPLY 

table contains only query and reply in Imports 

Sensitive 

63 

BE REAPPR 

table contains only re-apr date only in Imports 

Sensitive 

64 

BE STATUS 

table contains only status and flag in Imports 

Sensitive 

65 

A BE EXCHANG 

E 

table contains only amend exchange rate 
details in Imports 

Sensitive 

66 

A BE IGMS 

table contains all amend igm details in Imports 

Sensitive 

72 

A_BE_CONT 

table contains only amend container details in 
Imports 

Sensitive 

73 

DT NOTN PORT 

S 

Port code directory 

Sensitive 

77 

DT_NOTN_CNTR 

Y 

Notification of Country 

Sensitive 

79 

D CNTRY CD 

County Code 

Sensitive 

80 

D NS IEC 

Non standard IEC Code 

Sensitive 

82 

D PORT CD 

Port code detail 

Sensitive 

83 

DI EXAM ORD_ 
FRMT 

Examination % for sites 

Sensitive 

85 

DI RFQ CD 

Required taxes for Customs 

Sensitive 

86 

DE_IEC_SELFSE 

AL 

Self sealing sites 

Sensitive 

88 

DE CESS_SCHE 

D 

CESS certifications 

Sensitive 

89 

D_AIRLINE_IAT 

A 

Details of IATA code for airlines 

Sensitive 

90 

D_CUST_MASTE 

R 

Custom house master details 

Sensitive 

91 

D_CUSTODIAN 

Details of all Custodians 

Sensitive 

92 

D SHLINE 

Shipping line codes applicable to different ports 

Sensitive 

93 

D_AGENCY 

Details of agency DGCIS, LAB etc 

Sensitive 

94 

D AGENCY SIT 

E 

details of Agency working in which site 

Sensitive 

95 

D ITCHS 

ITCHS Code provide detail 

Sensitive 

96 

DT INT RATES 

Interest rates % 

Sensitive 

99 

DI DOC CD 

Details of Warehouses ( DOC) details 

Sensitive 

100 

DI_IMP_DUE 

Details of due pending with importers 

Sensitive 

101 

D_CHA_PAN 

Details of PAN details of CHA 

Sensitive 
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Classification of ICES Data Tables 

s 

No 

Table Name 

Data Description 

Classification of 
Data (Tentative) 

102 

D_CHA_POLICY 

Details of CHA policy 

Sensitive 

103 

D_CHA_POLICY 

ADD 

Details of branch site for CHA's 

Sensitive 

104 

D_CHA_OPRTNL 

POLSCTN 

Operational CHA details 

Sensitive 

105 

D CHA OPRTNL 
_POLSCTN_HIS 

T 

Suspended CHA details 

Sensitive 

106 

DE_DBK_SCHE 

D 

Drawback notifications details 

Sensitive 

107 

DE DBK_DOCLI 
ST 

Details of drawback against the DOC 

Sensitive 

108 

DE_RAW_MTRL 

directory of material details items of Raw items 

Sensitive 

109 

D_IEC_DGFT 

Details of IEC 

Sensitive 

110 

D_IEC_ADD_DG 

FT 

Address of IEC directory 

Sensitive 

111 

D SCHEME_CD 

Details of schemes code directory 

Sensitive 


Classification of ACES Data Tables 

S. 

No 

Table Name 

Data Description 

Classification of 

Data 

1 

RET TR6 TB 

Excise duty collection details reed from EASIEST 

Highly Sensitive 

2 

SRT TR6 TB 

Service Tax collection details reed from EASIEST 

Highly Sensitive 

3 

COM MESG P 
ROCSD_TB 

Table contains user name and password 

provided by the ACES application for ACES 
login. 

Highly Sensitive 

4 

ACL_USER_MAS 
TR TB 

Details of access provide to CE & ST dept users 

Highly Sensitive 

5 

COM_USER_MA 
STR TB 

CE and ST assessses regn data commisionrate 
wise 

Sensitive 

6 

SRT_UPLOADFIL 

E RETRNS TB 

Offline service tax return filing details 

Sensitive 

7 

COM_COMSNRT 
MASTR TB 

Table contains the details of ACES 
commisionrate name, code etc. 

Sensitive 

8 

SRG BUSNS U 
NIT TB 

Service tax assesses regn data, application push 

data to NSDL with the help of this table 

Sensitive 

9 

REG BUSNS U 
NIT TB 

Central Excise assesses regn data, application 

push data to NSDL with the help of this table 

Sensitive 

10 

D_IEC_DGFT; 

Table contains assesses data for import export 
code reed from DGFT 

Sensitive 

11 

SRF REFND C 
LAIM TB 

Service tax refund claim logged by assesses 

Sensitive 

12 

SRF REFND O 
RDER TB 

Details of processed ST refund orders payble to 

assesses. 

Sensitive 

13 

SRT ADV PAY 

Details of advance payment made by assesse for 

Sensitive 
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Classification of ACES Data Tables 

S. 

No 

Table Name 

Data Description 

Classification of 

Data 


MNT_DTLS_TB 

service tax 


14 

RET RC OTHR 
PAYMNTS TB 

Details of payment made by central excise 
assesses 

Sensitive 

15 

RET RC OTHE 

R PAYMNTS B 
REKP TB 

Breakup of payment made by central excise 

assesses 

Sensitive 

16 

SRG DOCMNT 
VERFCTN TB 

Details of document verfication for service tax 
regn. 

Sensitive 

17 

RET RT51 REJ 
CTD_TB 

Table containing details of causes for non 

updation of central excise duty amount to TR6 
table. 

Sensitive 

18 

REG NSDL SE 
ND FILE DETL 

S TB 

Details of file send to NSDL for central excise 

assesse data 

Sensitive 
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14. Annex G- Request Based Template 


| TEMPLATE FOR DATA REQUESTS BY EXTERNAL AGENCIES IN INDIA 

S.No. 

Particulars 

Description 

1 

Name of the Requesting 

Organisation 


2 

Mandate for seeking data 

(Whether Statutory/ 

MoU/Agreement etc) 


3 

Name of the Requestor - Single 

Point of Contact (SPOC) 


4 

Designation of the Requestor 


5 

Requestor's official e-mail ID 


6 

Requestor's direct contact No. 


7 

Requestor's official address 


8 

Data Requested - whether 

Customs/Central Excise/Service 

Tax 


9 

Brief Description of purpose 


10 

Data Elements Requested 

(Source of Element, if any. For 

example: 

Registration/Returns/Payments 

etc.) 


11 

Customs/Central Excise Tariff 

Head (if applicable)* 


12 

Time Period for which data 

requested 


13 

Format of Report, if any 
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14 


Additional Requirements, if any 


♦Non-provision of the Tariff Head would lead to delay in provision of the data 


UNDERTAKING (Not required in case of a valid Moil with CBEC) 

I/We. (Name of the Organisation) hereby state that 

the data requested above is required for official purposes only and I/we undertake to 
ensure that I/we shall accord as high a degree of security and confidentiality as we 
do to our own organisation's secure data. I/We also hereby undertake that I/we shall 
not further share the data provided by CBEC without taking CBEC's concurrence in 
writing. 


Signature 

Name. 

Place. 

Date. 


For CBEC's Internal Use 


Request Acknowledgement No. 

(S.No/DDmonYYYY; eg l/01jan2014) 

Request Received Date. 

Directorate of Systems File No., if any. 

Request Ticket No. (System generated), if any. 

Request Approved by 

Request Approval Date. 

Date of completion of request. 

Mode of transmission (Tick as applicable): 

On official e-mail ID 
Through Secure FTP 
On media (with approval) 

In hard copy 
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15. Annex H- Proposed Data sharing process 

1. All data requests to the Directorate of Systems should follow the following 
process: 

a. Head of the requesting agency should write to the CBEC providing the 
details of the request like the purpose of the data request, data fields 
required and the periodicity of the data sought. He would also appoint a 
Single Point of Contact (SPoC) for their department who would interact 
with the relevant officials of the DG Systems and convey his contact 
information (address, telephone number, fax and official e-mail id on NIC 
or other government domain) for further correspondence. Future separate 
or supplemental data requests from the same office could be sent to 
Directorate of Systems by the SPoC via either letter or e-mail. 

2. The request for data retrieval/analysis addressed to CBEC from External 
agencies would have to be first approved in principle by the Project Manager 
(EDW Project), CBEC before the feasibility of provisioning the data can be 
examined by the EDW team. 

3. Feasibility of provisioning the data requested would then be undertaken by 
the EDW team and they may contact the SPoC of the office requesting data 
for any clarifications required with approval from the Project Manager (EDW 
Project), CBEC. 

4. In case the data retrieval is not feasible, then the requesting agency would be 
immediately informed about the same. 

5. Once the data has been retrieved/analysed, the data has to be shared with 
the Project Manager (EDW Project), CBEC for review. 

6. After the review and corrections in the data, if any, the approval for sending 
the data would be required in writing from the DG (Systems) through the 
concerned ADG. 
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7. The data shall be sent only to the official e-mail ID of the SPoC (preferably 
NIC) of the office requesting for data. 


8. In case the data is large in size, the data shall be transferred to the 
concerned officer via SFTP (secured File Transfer Protocol). The modality of 
such SFTP will be governed by the methodology in Annex-D 

9. Usually no data shall be extracted on a portable media (CD, pen drive etc.). 

Exceptions to this rule may be considered only after approval by DG 
(Systems). 


10. All responses to the SPoC of the office requesting data after EDW Project 
Managers approval shall be routed through the EDW helpdesk. 

11. In case any data request by an External Agency is routed through a CBEC 
office then it would be treated as an internal request and response to the 
same would be sent to the concerned CBEC official. 

12. Logs of all the External data requests, correspondences/e-mails relevant 

thereto, and soft copies of data furnished would be kept with the EDW team 
for records. 


13. The steps mentioned above shall be followed for all Data Requests received 
from External Agencies. Any deviation from the same under exceptional 
circumstances may only be made with the due approval of the DG (Systems). 
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16. Annex I- Draft MoU 

MEMORANDUM OF UNDERSTANDING 

BETWEEN 

CENTRAL BOARD OF EXCISE AND CUSTOMS, MINISTRY OF FINANCE, 

GOVERNMENT OF INDIA 

& 


FOR 

EXCHANGE OF DATA FOR IMPROVING TAX COMPLIANCE 

This MoU made this_th/rd day of_ 


BETWEEN 


Central Board of Excise and Customs (CBEC), Department of Revenue, Ministry of 
Finance, Government of India and represented by Director General, Directorate 
of Systems (DOS), Customs & Central Excise, and/or person/s authorized by 
CBEC in writing to represent it in this regard, herein after referred to as "CBEC" 
(which expression shall unless excluded by or repugnant to the context deemed to 
include its successor/s in office or assign) or party of the FIRST PART. 

AND 


-and/or person/s authorized by_in 

writing to represent it in this regard, herein after referred to as 

(which expression shall unless excluded by or repugnant to the context deemed to 

include its successor/s in office or assign) or party of the SECOND PART. 
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Whereas It has been agreed that there needs to be a structured mechanism for 

regular exchange of identified data fields between CBEC and_for 

- (purpose of signing the Moll) this Memorandum of 

Understanding (MoU) is hereby executed by parties of the first and second part: 

Article 1 

Object and Scope 

1.1 The "Memorandum of Understanding", hereinafter referred to as "the 
MoU", specifies the terms and conditions under which the parties will exchange 
data. 

1.2 The MoU consists of the provisions set out as under and shall be 
completed by the Annexures, which will form an integral part of this MoU 

1.3 Unless otherwise agreed by the parties, the exchange of data shall be in 
secure electronic mode. 


Article 2 
Definitions 


For the purpose of the MoU, the following terms are defined as follows: 

2.1 Transmitting Party: Party of the first or second part as the case may be, 
which is providing data 

2.2 Receiving Party: Party of the first or second part as the case may be, to 
whom data is being provided. 


2.3 Financial Year: A Financial Year is year in which income is earned and is a 
period of twelve months commencing from 1 st April of a year to 31 st March of the 
following year. 


Internal 


Page 40 of 49 
















Data Sharing policy V 0,1 


Central Board of Excise and Customs 


2.4 Assessment Year: Assessment year means the period of twelve months 
commencing on 1st April every year and ending on 31st March of the next year 
immediately following the Previous Year. 

2.5 Business Day: A business day means any day except a Saturday, Sunday or 
any gazetted public holiday at the location of the Receiving Party. 

2.6 LTU: A LTU is self-contained tax office under the Department of Revenue 

acting as a single window clearance point for all matters relating to Central 

Excise, Income Tax/ Corporate Tax and Service Tax. 

Article 3 

Validity and Conformity 

3.1 The MoU is valid for period of three years and will be effective from 

-(Date).After the expiry of the validity, the MoU may be extended 

by mutual consent of both parties 

3.2 Each Party shall ensure that the data sent or received is in conformity with 
the agreed formats and frequency as specified in Annexure 

Article 4 

Use of Exchanged Data in a Legal Proceedinn 

To the extent permitted by Indian law which may apply, the parties hereby agree 
that in the event of the data so exchanged being required to be produced in a 
court of law for a civil or criminal proceeding, the data relied upon shall be 
substantiated by documentary evidence and other statutory documents as 
applicable under the Customs Act, Central Excise Act, Service Tax Laws under 
Finance Act 1994 and any other law for the time being in force. 
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Article 5 

Modality of Exchange and acknowledgement of receipt 

5.1 Unless otherwise warranted data shall be exchanged in a secure electronic 
mode. 

5.2 Unless otherwise warranted acknowledgement of receipt shall be sent 
electronically. 

5.3 The Receiving Party shall ensure that an acknowledgement is sent to the 
transmitting Party within two business days of receipt of the data, unless an 
alternative time limit has been mutually agreed. 

5.4 The Receiving and Transmitting Parties shall both maintain a Date & Time 
stamped record of the files transmitted and received. 

Article 6 

Security of Data Shared 

6.1 The parties undertake to implement and maintain security procedures 
and measures in order to ensure the protection of data shared against the risks of 
unauthorized access, alteration, delay, destruction or loss. 

6.2 Security procedures and measures may include the verification of origin, 
the verification of integrity, the non-repudiation of origin and receipt and the 
confidentiality of data shared. Where warranted, additional security 
procedures and measures may be expressly specified and mutually agreed. 

6.3 If the use of security procedures and measures results in the rejection of, or 
in the detection of an error in the data shared, the receiver shall inform the sender 
thereof, within the specified time limit. 

Where a rejected or erroneous data is retransmitted by the sender, the data should 
clearly state that it is a retransmission of corrected data. 
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Article 7 

Confidentiality, protection and storage of data 

7.1 The parties shall ensure that data containing information specified to be 
confidential by the sender or agreed mutually to be confidential between the parties, 
are maintained in confidence and are not disclosed or transmitted to any 
unauthorized persons nor used for any purposes other than those intended by the 
parties. 

When authorized, further transmission of such confidential information shall be 
subject to the same degree of confidentiality. 

7.2 Shared Data shall not be regarded as containing confidential information to the 
extent that such information is in the public domain. 

7.3 The parties may agree to use a specific form of protection for data such as a 
method of encryption to the extent permitted by law. 

7.4 A complete and chronological record of all shared data exchanged by the 
parties shall be stored by each Party, unaltered and securely, in accordance with 
the time limits and specifications prescribed by legislative requirements and in any 
event, for the duration of the Moll. 


Article 8 

Operational requirements for Data Exchange 

8.1 The parties undertake to implement and maintain an operational 
environment to operate 

data exchange according to the terms and conditions of this MoU, which includes 
but is not limited to the following: 

a. Operational equipment 
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The parties shall provide and maintain, the equipment, software and 
services necessary to transmit, receive, record, process and store the data 
shared. 

b. Mode of communication 

Unless otherwise specified, the default mode of communication in respect of 
operational matters related to data exchange shall be the official email of 
the persons authorized by the parties. 

Article 9 

Responsibilities of Parties 
9.1 Responsibilities of Parties 

Parties shall provide the following to facilitate the exchange of data: 

i. Appoint nodal officer(s) to act as point of contact for coordinating the 
exchange of data. 

ii. Accord due priority and resources for timely completion of tasks related to 
exchange of data. 

iii. Establish a mechanism for resolving data quality issues, if any, within a 
reasonable timeframe. 

iv. Establish a mechanism for periodic review of exchange of data and results 
thereof. 

Article 10 

General Terms and Conditions 

10.1 No Commercial Consideration 
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The Parties mutually agree that there exist no commercial considerations in respect 
of this Moll. 

10.2 Indemnification 

CBEC and - agree to indemnify each other against consequential effects 

arising out of steps taken under this Moll. 

10.3 Force Majeure (can be taken off as there is no commercial 

consideration here) 

'• --— ar| d CBEC shall not be liable for failure to meet obligations due 

to Force Majeure. 

ii. Force Majeure impediment is taken to mean unforeseen events, which occur 
after signing of this MoU including but not limited to strikes, blockade, war, 
mobilization, revolution or riots, natural disaster, acts of God, refusal of 
license by State/Central Government authorities, in so far as such an event 
prevents or delays the contractual Party from fulfilling its obligations. 

iii. In case the Force Majeure conditions continue for more than 60 days, all the 
Parties shall discuss the effect of such conditions on the MoU and mutually 
decide the course of action to be followed. 

A Party to this Mou cannot be sued in any Court of Law for being unable to perform 
as per the stipulations of the MoU due to circumstances beyond its control. 

10.4 Deviations and Dispute Resolution 

On all aspects where the above articles of understanding are silent, for special cases 
of deviation from these articles, the decision mutually agreed upon between 
_and CBEC will be final. 

10.5 Dispute Resolution 
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In the event of any dispute relating to or arising out of this MoU, such dispute shall 
be resolved amicably by mutual consultation. If such resolution is not possible, then 
the unresolved dispute or difference shall be referred to a committee consisting of 
the Secretary (Revenue), Chairperson CBEC, _and any member co¬ 

opted by the other party, whose decision shall be binding on both Parties. 


10.6 Exit Clause 

Either of the parties can terminate this MoU by giving three-month notice to each Party 
as per mutually decided terms and conditions. 

On expiry/termination of this MoU, any Party to the MoU shall not assume any 
responsibility/liability in any form - technical, legal, financial etc for any eventual 
consequences to the other Party, for events arising after such expiry/ termination. 

10.7 Amendment to MoU 

No verification in or modification of the terms of this MoU shall be made except by 
written amendment signed by both the parties 

IN WITNESS WHEREOF the parties have executed in duplicate on the day and year, 
hereinafter indicated. 


FOR AND BEHALF OF CBEC 


FOR AND BEHALF OF 


Signature 

Name: 

Designation: 
Dated : 
Place: 


Signature 

Name: 

Designation: 

Dated: 

Place: 


IN THE PRESENCE OF IN THE PRESENCE OF 

Signature Signature 
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Name: 
Designation 
Dated : 
Place: 


Name: 

Designation: 

Dated: 

Place: 
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17. Annex J-Definitions 


S.No. Term Definition 


1 

EDW 

An Enterprise Data Warehouse (EDW) is a central 
repository of the business information designed for 
query and analysis rather than for day-to-day 
transaction processing. It contains both data from 
multiple applications and historical data. 

2 

ISO 27001 

ISO 27001 is an information security standard 
published by the International Organization for 
Standardization (ISO) and the International 
Electrotechnical Commission (IEC) under the joint 
ISO and IEC subcommittee, ISO/IEC JTC 1/SC 
27.[2] It is a specification for an information 
security management system (ISMS). An ISMS is a 
systematic approach to managing sensitive 
company information so that it remains secure. It 
includes people, processes and IT systems by 
applying a risk management process 

3 

IT ACT 2000 

J 

Information Technology Act (IT Act) is an Act to 
provide legal recognition for transactions carried out 
by means of electronic data interchange and other 
means of electronic communication, commonly 
referred to as "electronic commerce", which involve 
the use of alternatives to paper-based methods of 
communication and storage of information, to 
facilitate electronic filing of documents with the 
Government agencies and further to amend the 
Indian Penal Code, the Indian Evidence Act, 1872, 
the Bankers' Books Evidence Act, 1891 and the 
Reserve Bank of India Act, 1934 and for matters 
connected therewith or incidental thereto. 
Information Technology Act 2000 addressed the 

following issues: 
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1. Legal recognition of electronic documents 

2. Legal Recognition of digital signatures 

3.Offenses and contraventions 

4.Justice dispensation systems for cybercrimes 

4 

NDA 

Non Disclosure Agreements (NDA) is a 

confidentiality agreement or contract creating a 
legal obligation to privacy and compels those who 
agree to keep any specified information secured or 

secret. 

5 

SFTP 

Secure File Transfer Protocol (SFTP) is a network 

protocol that provides file access, file transfer and 
file management functionalities over any reliable 

data stream. 

6 

XML 

Extensible Markup Language (XML) is a markup 
language that defines a set of rules for encoding 
documents in a format that is both human-readable 

and machine-readable. XML is a flexible way to 

create common information formats and share both 

the format and the data on the World Wide Web, 
intranets, and elsewhere. XML was created to 
structure, store and transport information. Although 
the design of XML focuses on documents, it is widely 
used for the representation of arbitrary data 
structures, for example in web services. 
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F.No.lV(26)/17/2014-SYStems//J^3S’ JO /Si// 
Directorate General of Systems & Data Management 
Customs & Central Excise 

New Delhi, 22 nd May, 2014 

Since I have assumed additional charge as DG, Systems a couple of days 
back, I have tried to takes stock of the situation in the directorate. On the basis of 
the same, the issues that needs to be looked into, and worked upon a on priority 

A 

basis are 

(1) A comprehensive scheme for IT and e-governance in CBEC, consisting of 
the software, hardware requirements, manpower, infrastructure and 
related matter, needs to be formulated to be in operation for atleast the 
next 5 years. Ideally we should have formulated a plan scheme at the 
beginning of the current plan with a total outlay and year-wise outlay. As 
the same was not done, we can still do it as a non plan scheme, after taking 
approval of the competent authority including the Cabinet, as per the laid 
down instructions of the Department of Expenditure, Ministry of Finance. 
The earlier 'CBEC consolidation scheme' has come to a close on 31 st March, 
2014 and because a new scheme was not yet in^place, extension of 2 years 
have been taken for certain critical components with the approval of the 
Secretary Revenue and Ministry of Finance, valid upto March, 2016. Hence 
the new scheme needs to be formulated immediately . All the ADGs in the 
Directorate will work together and put-up the draft scheme within a period 
of 5 weeks. Recommendation of HPC wherever relevant can be 
incorporated when received. 

Action : All ADGs/ Coordination by ADG to DG 

There does not appear to be any policy for sharing of information/data 
with other Departments, private organizations etc. A policy to this effect 
needs to be put in place immediately. Other Departments of Government 



* 

7 



of India like the Department of IT and Telecom, NIC, Income Tax etc. may 
be consulted in this regard. This should be put up by 10 th June, 2014. 

Action : Addl. Director (Ms. Shubhagata Kumar) 

ADG ( Sh. Vivek Chaturvedi) 

(3) A list of urgent pending works (Brief) to be put up to the undersigned by 
all the ADG's by 26.10.2014 positively. 



(Ananya Ray) 
Director General (Systems) 


Copy to: 


1. Secretary (Revenue) for kind information. 

2. Chairperson CBEC and Member Computerization for kind information. 

3. All ADGs in the Directorate of Systems, ^ 

4. ADG (Sh. Yogender Garg) to coordinate, review and put-up with 
positions before the due date. 
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From: 

To: 

Cc: 


Vivek Chaturvedi/CBEC 

Rahul SinhaPWC/CBEC@CBEC, Radhika Arorapwc/CBEC@CBEC 
Shubhagata Kumar/CBEC@CBEC 


Date: Tuesday, July 15, 2014 04:09PM 

Subject: p w: Draft Data Sharing Policy of CBEC 


I am forwarding 3 responses received so far- another 2-3 are expected by tomorrow- please go 
through the same and incorporate these in the original draft- if the changes suggested are 
radical, do flag them and discuss with both of us. 

Vivek Chaturvedi. 

.Forwarded by Vivek Chaturvedi/CBEC on 15-07-2014 16:19 . 

From: Gautam Bhattacharya/CBEC 
To: Vivek Chaturvedi/CBEC@CBEC 

Cc: Arti Srinivas/CBEC@CBEC, Bashistha Prasad/CBEC@CBEC, debi dash/CBEC@CBEC, Maninder 
Singh/CBEC@CBEC, Satendra Singh/CBEC@CBEC, shubhagata kumar/CBEC@CBEC, SK 
Vimalanathan/CBEC@CBEC, yogendra garg/CBEC@CBEC 
Date: 09-07-2014 16:14 

Subject: Re: Draft Data Sharing Policy of CBEC 


Dear All, 

The efforts that has gone into preparing the draft DSP is commendable. However, I would like to 
share my thoughts with others on certain issues mentioned in the draft DSP,- 

(1) Para 3: While categorization of personal/ individual data as highly sensitive is 
understandable, the distinction between sensitive and non-sensitive is not so. In both cases 
aggregation is being done. It is only a matter of degree that appears to determine the 
classification between the two categories. This can lead to arbitrariness. So far there is an 
aggregation (even of say two manufacturer or importer) the data looses its specificity (i.e. 
individuals identity). Unless named,such an aggregation, in my view is non-sensitive.In any case 
if we compare the users (tables under para 4.1 &4.2 J there is hardly any difference (except RTI) 
between those who have been proposed to be allowed access of 'sensitive' data from 'non- 
sensitive data. Therefore, I feel that there should be only two categories (sensitive & non- 
sensitive) instead of three categories proposed. 

(2) Para3: If the person and individual himself asks for his own data, it should be provided to him 
even though it is sensitive/highly sensitive. This can be done with a password/OTP or similar 
protection. This is similar to a credit card holder asking details of his own transaction. Besides 
bringing in transparency it may help the individual to detect his own/department's mistake in 
data feeding. 

(3) Para4: The draft DSP is not so clear about the access to data by private parties/institutions/ 
research scholars/analysts. Whatever data is categorized as non-sensitive, should made available 
in public domain ( say CBEC web-site) in defined format (i.e. what is considered to be of general 
interest) , suo moto. This would enhance the level of transparency of the department. In case 
non-sensitive data is asked for by a non-govt, agency on ad hoc basis or in non-standardized 
format, the same can be provided on charging 'processing charges'. This way EDW can become a 
profit-center as well. 

(4) Para 4.2 Table : Even if it is highly sensitive, denial of information to Parliament on being 
asked specifically, would invite 'Privilege Issue'. 
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Regards^ S ° Und rebe " i0US “ ‘ the DSP should * ^ ™re to ’share' than to 'hide'. 
Gautam Bhattacharya 


.Vivek Chaturvedi/CBEC wrote:. 

To: Maninder Singh/CBEC@CBEC, debi dash/CBEC@CBEC 
yogendra garg/CBEC@CBEC, Satendra Singh/CBEC@CBEC 
From: Vivek Chaturvedi/CBEC 
Date: 07/03/2014 06:58PM 


Gautam Bhattacharya/CBEC@CBEC, 
Arti Srinivas/CBEC@CBEC 


Cc: Shubhagata Kumar/CBEC@CBEC, Bashistha 
Vimalanathan/CBEC@CBEC 


Prasad/CBEC@CBEC, SK 


Subject: Draft Data Sharing Policy of CBEC 


Dear All, 

d"“at“ sharing poNcy of CBEC. DG System has 

comments on this living dolmen? '?' Uable inputs and 

which would then be put up for consideration by the Board ' 3 V ' eW evolve 


Regards, 

Vivek Chaturvedi. 


(See attached file: CBEC Data Sharing Policy_v0.1.docx) 


[attachment "CBEC Data Sharing Policy_v0.1.docx" removed by Gautam 


Bhattacha rya/CB EC] 
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From: Vivek Chaturvedi/CBEC 

To: Rahul SinhaPWC/CBEC@CBEC, Radhika Arorapwc/CBEC@CBEC 

Cc: Shubhagata Kumar/CBEC@CBEC 


Date: Tuesday, July 15, 2014 04:10PM 

Subject: p w: Draft Data Sharing Policy of CBEC 
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.Forwarded by Vivek Chaturvedi/CBEC on 15-07-2014 16:22 

From: debi dash/CBEC 

To: Vivek Chaturvedi/CBEC@CBEC 

Date: 10-07-2014 10:11 

Subject: Fw: Draft Data Sharing Policy of CBEC 


-Forwarded by debi dash/CBEC on 07/10/2014 10:21 AM 

From: SK Vimalanathan/CBEC 
To: debi dash/CBEC@CBEC 
Date: 07/09/2014 07:37 PM 

Subject: Re: Fw: Draft Data Sharing Policy of CBEC 


Sir, 

Please find attached the comments on the CBEC's data sharing policy. 

Yours faithfully 

S.K.Vimalanathan 

.debi dash/CBEC wrote:. 

To: SK Vimalanathan/CBEC@CBEC, Ch Reddy/CBEC@CBEC, Ankur Guptapwc/CBEC@CBEC 

From: debi dash/CBEC 

Date: 07/03/2014 07:35PM 

Cc: Anubha Sinha/CBEC@CBEC 

Subject: Fw: Draft Data Sharing Policy of CBEC 

For comments pi 
DP 

.Forwarded by debi dash/CBEC on 07/03/2014 07:45 PM. 

From: Vivek Chaturvedi/CBEC 

To: Maninder Singh/CBEC@CBEC, debi dash/CBEC@CBEC, Gautam Bhattacharya/CBEC@CBEC, 
yogendra garg/CBEC@CBEC, Satendra Singh/CBEC@CBEC, Arti Srinivas/CBEC@CBEC 
Cc: Shubhagata Kumar/CBEC@CBEC, Bashistha Prasad/CBEC@CBEC, SK 
Vimalanathan/CBEC@CBEC 
Date: 07/03/2014 06:58 PM 


https://webmail.icegate.gov.in/mail/80001189.nsf/(%241nbox)/BE0F36B81056D3BF6525... 8/21/2014 



















Subject: Draft Data Sharing Policy of CBEC 
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Dear All, 

Please find attached the first draft of the proposed data sharing policy of CBEC. DG Systems has 
desired that all teams within the Directorate of Systems may provide their valuable inputs and 
comments on this living document by next Friday, July 11, 2014 , so that a final view can evolve 
which would then be put up for consideration by the Board. 


Regards, 

Vivek Chaturvedi. 


[attachment "CBEC Data Sharing Policy_v0.1.docx" deleted by debi dash/CBEC] (See attached 
file: RMD's Comments on CBEC's data sharing policy..docx) 

Attachments: 

RMD's Comments on CBEC's data sharing policy..docx 
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Data Categorisation 

Input Points requested from all DoS Teams 

1. Kindly provide your thoughts on further data categorisation, if any. 

RMD's View : In the data sharing policy document, it has been categorized as 
highly sensitive, sensitive and non-sensitive. This categorization has been 
made based upon the sensitive nature of the data, whereas CBEC stores data 
which come into existence through the following means : 

a) Declared details : The tax payer provides information to the 
department in the form of declarations (bill of entry / shipping bill). 
Returns (Central Excise and Service Tax). 

b) Data come into existence on account of CBEC's role : On account of 
Assessment, Enforcement and Risk Analysis functions carried out 
during the course of functioning of the department. The details 
namely, seizure details, RMS interdiction details etc. 

c) Data received from other agencies : Some data are received from 
other agencies like RBI, DGFT, etc. for carrying out specified functions 
under CBEC. 

Part of the declared details relating to individual taxpayers can be 
considered as Highly Sensitive, whereas the remaining details can be 
considered as Sensitive. The data comes into existence during the 
Customs and Central Excise related work, can also be considered as 
Highly Sensitive, which can be shared only to specified agencies. The 
RMS interdiction details, the data received from other agencies fall 
under non-sharable category. 

2. Kindly provide inputs on the data points that should form part of the 
respective categories. 

RMD's View : 

Customs : 

a) Highly Sensitive : Any entity wise data like Importer, Exporter, 
Supplier, CHA, Shipping Lines, CFS Operator, Warehouse Operator, 
Transhipment Operators, Authorised Dealers, etc. 

b) Sensitive : Notification wise details, Port of Shipment wise. Country of 
Discharge, Port of Discharge, Country of Destination, Port of 
Destination, Model wise, Brand wise, etc. 

c) Non Sensitive : Duty foregone, IPR details, etc. 

3. Kindly provide inputs on 'exception' data that should not be shared at 
all. 

RMD's View : The information contained in DRIPS, Offence data, RMS 
Interdiction details are non-sharable. 

4. Kindly provide your inputs on the Risks associated with each of the 
data category 

RMD's View : 

a) Unintended use : The agencies which take the data from CBEC with 
certain specified purpose later go on to use for unintended purposes. 


b) Usage before court of law : The agencies may take the data from CBEC 
later the same will be used before the court of law. Before such usage 
a prior concurrence from CBEC need to be taken. 

5. Kindly provide the safeguards to be taken for each data category 

User Categorisation 

Input Points requested from all DoS Teams 


1. Kindly provide your inputs on any other user category to be considered 
but not captured in the table above. 

RMD's View : 

Internal users : Though RMD is also a major contributor for data under CBEC, but 
the data available in ACES to be provided to RMD. RMD has to be specifically 
included as the internal user. All the 3 categories, namely, Highly Sensitive, 
Sensitive, and Non Sensitive shall be made available to RMD. 

External users : All the other governmental departments like Ministry of 
Agriculture, Ministry of Chemicals and Fertilizers, Ministry of Environment and 
Forest, FSSAI, etc. need data from CBEC w.r.t various commodities for their 
policy decision. Moreover when RMD grows into Targeting Centre, there is co¬ 
ordination required from other agencies also. 

2. Kindly provide your views on the user access rights to data categories 
listed in the table above. 

RMD's View : CBI does not require any periodical data. They can be provided with 
individual taxpayer's data on request. All the other government departments (OGD) 
can be given sensitive and non sensitive data. 

3. Kindly provide your inputs on whether the policy should allow exceptions 
or opt-outs. Also , please indicate if there are any binding/statutory 
requirements on part of CBEC to share data, and if so the level of 
granularity of such data. 

RMD's View : The policy should allow exceptions that certain data need not be 
shared with other agencies. 

Modalities of Data Sharing 

Input Points requested from all DoS Teams 

1. Kindly provide inputs on the other modes of data sharing with 
internal users 

RMD s view: Handshake between few applications like RMS, ACES, ICES and 
DW may also be considered. 

2. Kindly provide inputs on the other modes of data sharing with 
external users 

3. Kindly provide your inputs on specific agencies which require 

Memorandum of Understanding (MoU) for sharing of data for mutual 
benefit. 


RMD s view: Most of the other governmental departments require 
Memorandum of Understanding. 

4. Kindly provide your inputs on the penal provisions to be imposed for 
breaching the confidentiality clause. 

RMD's view: Since the data sharing is between other Government agencies 
the penal action can be limited to stoppage of further data sharing. 

Funding For Data Sharing 

Input Points requested from all DoS Teams 


1. Should CBEC levy a charge for the information provided to meet the 
cost of generation, collection, retention and dissemination of 
information? 

RMD's view: As CBEC also requires data from other agencies, there is no need 
for any charges to be levied to these agencies. 

2. Please provide your views on whether atleast voluminous data is 
charged for. 

RMD's view: As CBEC also requires data from other agencies, there is no need 
for any charges to be levied to these agencies. 

Input Points requested from all DoS Teams on 2 Generic Points 

1. Kindly provide inputs on whether such information sharing should 
remain a one way exercise? If not, please elaborate on the data 
elements and the key agencies from which such data if made 
available would be helpful to the CBEC. 

RMD's view: From the following data and the agencies are required for CBEC. 

1. PAN data base of Income Tax 

2. Income Tax offenders with evasions of over Rs. 1 crore. 

3. IEC data base of DGFT 

4. Immigration data 

5. Details of offenders available with NCB 

6. Data of annual returns of companies with Registrar of Companies. 

7. MCA 21 of Registrar of Companies. 

8. FETERS (Foreign Exchange Transactions Electronic Reporting System) of 
RBI 

9. Data on licenses issued by DGFT 

10. DGFT defaulters/offenders 

11. SCN issued by Serious Fraud Investigations office. 

12. SCN issued by Enforcement Directorate. 

13. SEZ offenders 

14. Details of consignments wherein Plant / Animal quarantine /FSSAI/ 
Assistant Drug Controller etc. detect infringements. 

15. SCOMET list with their common names, trade names, popular names and 
details for identification. 




16. List of applicants for permission for SCOMET items with DGFT 

17. SEBI defaulters, debarred and suspended companies, 

18. RBI list of defaulters to Public Sector Banks. 

2. Kindly provide inputs on the data required from Ministry of Commerce 
specifically on SEZ data which is currently not available with CBEC. 
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From: Vivek Chaturvedi/CBEC 

To: Rahul SinhaPWC/CBEC@CBEC, Radhika Arorapwc/CBEC@CBEC 

Cc: Shubhagata Kumar/CBEC@CBEC 

Date: Tuesday, July 15, 2014 04:10PM 

Subject: pw: Draft Data Sharing Policy of CBEC - comments 


.Forwarded by Vivek Chaturvedi/CBEC on 15-07-2014 16:22 

From: debi dash/CBEC 

To: Vivek Chaturvedi/CBEC@CBEC 

Date: 11-07-2014 19:02 

Subject: Fw: Draft Data Sharing Policy of CBEC - comments 


.Forwarded by debi dash/CBEC on 07/11/2014 07:12 PM 

From: Ch Reddy/CBEC 

To: debi dash/CBEC@CBEC, Anubha Sinha/CBEC@CBEC 
Cc: Ravi Edara/CBEC@CBEC, Kalyan Iyer/CBEC@CBEC 
Date: 07/11/2014 05:55 PM 

Subject: Fw: Draft Data Sharing Policy of CBEC - comments 


Sir, 

The comments of DGS Chennai on above subject, enclosed. 

Venkat Reddy, Ch 
ADD, Chennai. 

.Forwarded by Ch Reddy/CBEC on 07/11/2014 05:24AM. 

To: Ch Reddy/CBEC@CBEC 
From: Ravi Edara/CBEC 
Date: 07/11/2014 04:14AM 

Cc: hqadmin prime/CBEC@CBEC, I aparna/CBEC@CBEC, Maheswari M/CBEC@CBEC, 
Somasundaram Chandrasekharan/CBEC@CBEC, Subramanian Srinivasan/CBEC@CBEC, Kalyan 
Iyer/CBEC@CBEC, Gururaghavendran Gopinatharao/CBEC@CBEC, Saumyanarayanan Vasudevan 
Kidambi/CBEC@CBEC, Sivakumar Venkatraman/CBEC@CBEC, Sharada 
subramanian/CBEC@CBEC, Ajayl Prasad/CBEC@CBEC, Rajagopalan 
Suryanarayanan/CBEC@CBEC, geethal santhosh/CBEC@CBEC, Haseena R/CBEC@CBEC, v 
srinivas/CBEC@CBEC, Rajanikanth B S/CBEC@CBEC, Sambandan Sarangapany/CBEC@CBEC 
Subject: Draft Data Sharing Policy of CBEC - comments 

(See attached file: CBEC Data Sharing Policy - comments by DD.docx) 

Sir, some comments from my side attached in track-change mode. If approved, we may send the 
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comments today as desired by HQR's. 
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Yours, 

'Ravi Kiran, DD. 

-Kalyan Iyer/CBEC wrote:. 

To: Ch Reddy/CBEC@CBEC 
From: Kalyan Iyer/CBEC 
Date: 07/10/2014 04:25PM 

Cc: Ravi Edara/CBEC@CBEC, I aparna/CBEC@CBEC, Subramanian Srinivasan/CBEC@CBEC, 

hqadmin prime/CBEC@CBEC, Maheswari M/CBEC@CBEC, Somasundaram 

Chandrasekharan/CBEC@CBEC 

Subject: Fw: Draft Data Sharing Policy of CBEC 

Sir, 

please refer to yesterday's meeting & deliberations in the captioned subject matter. 

As directed/discussed the points have been consolidated and submitted under the 
header "DGS CHENNAI'S COMMENTS" in RED, for your approval. 

Thanks & Regards 
Kalyan Iyer 
SP/DGS/Chennai 
Landline no.044-28331116 
Mobile no. 09940752548 


(See attached file: CBEC Data Sharing Policy_v0.1.docx) 

-Forwarded by Kalyan Iyer/CBEC on 10-07-2014 16:22 - 

From: I aparna/CBEC 

To: Somasundaram Chandrasekharan/CBEC@CBEC, Maheswari M/CBEC@CBEC, Kalyan 
Iyer/CBEC@CBEC, hqadmin prime/CBEC@CBEC, Rajanikanth B S/CBEC@CBEC, 
acesst@gmail.com, pasvenkat@rediffmail.com, Haseena R/CBEC@CBEC, Sambandan 
Sarangapany/CBEC@CBEC, "DG(SYSTEMS) ACES SD" <dgsys.sd@gmail.com>, Meera 
Hari/CBEC@CBEC, 

Date: 09-07-2014 12:38 

Subject: Fw: Draft Data Sharing Policy of CBEC 


For your information and necessary action 
L Aparna 

Directorate of Systems 
Chennai 


Forwarded by I aparna/CBEC on 07/09/2014 12:34PM 
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To: Ravi Edara/CBEC@CBEC, v srinivas/CBEC@CBEC, Sharada subramanian/CBEC@CBEC, I 

aparna/CBEC@CBEC, Gururaghavendran Gopinatharao/CBEC@CBEC, Subramanian 

Srinivasan/CBEC@CBEC 

From: Ch Reddy/CBEC 

Date: 07/09/2014 11:08AM 

Subject: Fw: Draft Data Sharing Policy of CBEC 

Dear All, 

PI. go through the attachment, let us discuss it today afternoon. 

Venkat Reddy. 

.Forwarded by Ch Reddy/CBEC on 07/08/2014 10:38PM. 

To: Ravi Bhatt/CBEC@CBEC, Ch Reddy/CBEC@CBEC 

From: debi dash/CBEC 

Date: 07/08/2014 03:57AM 

Subject: Fw: Draft Data Sharing Policy of CBEC 


.Forwarded by debi dash/CBEC on 07/08/2014 04:37 PM. 

From: Vivek Chaturvedi/CBEC 

To: Maninder Singh/CBEC@CBEC, debi dash/CBEC@CBEC, Gautam Bhattacharya/CBEC@CBEC, 
yogendra garg/CBEC@CBEC, Satendra Singh/CBEC@CBEC, Arti Srinivas/CBEC@CBEC 
Cc: Shubhagata Kumar/CBEC@CBEC, Bashistha Prasad/CBEC@CBEC, SK 
Vimalanathan/CBEC@CBEC 
Date: 07/03/2014 06:58 PM 

Subject: Draft Data Sharing Policy of CBEC 


Dear All, 

Please find attached the first draft of the proposed data sharing policy of CBEC. DG Systems has 
desired that all teams within the Directorate of Systems may provide their valuable inputs and 
comments on this living document by next Friday, July 11, 2014 , so that a final view can evolve 
which would then be put up for consideration by the Board. 


Regards, 

Vivek Chaturvedi. 

(See attached file: CBEC Data Sharing Policy_v0.1.docx)[attachment "CBEC Data Sharing 
Policy_v0.1.docx" deleted by Kalyan Iyer/CBEC] 


[attachment "CBEC Data Sharing Policy_v0.1.docx" removed by Ravi Edara/CBEC] (See attached 
file: CBEC Data Sharing Policy - comments by DD.docx) 

Attachments: 
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From: Vivek Chaturvedi/CBEC 

To: Rahul SinhaPWC/CBEC@CBEC, Radhika Arorapwc/CBEC@CBEC 

Date: Friday, July 18, 2014 10:24AM 

Subject: pw: Draft Data Sharing Policy of CBEC 


-Forwarded by Vivek Chaturvedi/CBEC on 18-07-2014 10:36 - 

From: Arti Srinivas/CBEC 

To: Vivek Chaturvedi/CBEC@CBEC 

Cc: Bashistha Prasad/CBEC@CBEC, debi dash/CBEC@CBEC, Gautam Bhattacharya 
<geebeetru@gmail.com>, Maninder Singh/CBEC@CBEC, Satendra Singh/CBEC@CBEC, 
Shubhagata Kumar/CBEC@CBEC, SK Vimalanathan/CBEC@CBEC, yogendra garg/CBEC@CBEC, 
Ananya Ray/CBEC@CBEC, Nsm Ices/CBEC@CBEC, y.garg@nic.in 
Date: 17-07-2014 19:07 

Subject: Re: Draft Data Sharing Policy of CBEC 


Pis find enclosed comments as desired. 

(See attached file: comments Data sharing policy.docx) 

Arti Agarwal Srinivas, 

ADG (ICES) 

Vivek Chaturvedi—07/14/2014 01:07:21 PM—Dear All, Please refer to the trail mail ; so far 
comments have been received from Gautam Sir , RM 

From: Vivek Chaturvedi/CBEC 
To: Maninder Singh/CBEC@CBEC 

Cc: debi dash/CBEC@CBEC, Gautam Bhattacharya <geebeetru@gmail.com>, yogendra 
garg/CBEC@CBEC, Satendra Singh/CBEC@CBEC, Arti Srinivas/CBEC@CBEC, Shubhagata 
Kumar/CBEC@CBEC, SK Vimalanathan/CBEC@CBEC, Bashistha Prasad/CBEC@CBEC 
Date: 07/14/2014 01:07 PM 
Subject: Draft Data Sharing Policy of CBEC 


Dear All, 

Please refer to the trail mail ; so far comments have been received from Gautam Sir , RMD and 
ACES team ; no comments have been received from ICEGATE, ICES 8i LAN/WAN Project heads. 
DG Systems has directed that all comments should be sent to the undersigned by Wednesday so 
that we are able to compile the same and put up the draft document to her by end of this week. 

Regards, 

Vivek Chaturvedi 
Commissioner EDW. 

-Forwarded by Vivek Chaturvedi/CBEC on 14-07-2014 13:13 - 
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From: Vivek Chaturvedi/CBEC ,r B crarRFr 

To: Gautam Bhattacharya/CBEC@CBEC, Ansny R „ rREC debj dash/CBEC@CBEC, Maninder 

ISSSLc&c. sk 

Vimalanathan/CBEC@CBEC, yogendra garg/CBEC@CBEC 


Date: 11-07-2014 17:53 

Subject: Re: Draft Data Sharing Policy of CBEC 


Dear All, 

Please refer to ™ ai ' J 3 *®J 4 °^° 0 7 fa ? commen^ffro^GalTam^ir 6 a^dRMD only^ave been 
?eceive 9 d P °I would^ request the Jther teams to offer their comments by coming Monday so that 
[he final document may be prepared for CBEC's approval. 

ADG ICEGATE is requested to fill in the specific points pertaining to ICEGATE as highlighted in the 
said draft. 


Regards, 

Vivek Chaturvedi 
Commissioner EDW. 


Gautam Bhattacharya-09-07-2014 16:14:41-Dear All, 
preparing the draft DSP is commendable. However, I would 


The efforts that has gone into 
li 


From: Gautam Bhattacharya/CBEC 

£=. ^sS^cIlBfc^shistha Prasad/CBECSCBEC, debi das W E C c B ! C c f E C c BE s ^ Manlnder 
Singb/CBEC@CBEC, Satendra Singh/CBEC@CBEC, shubhagata kurwr/CBEC@CBEC, 
Vimalanathan/CBEC@CBEC, yogendra garg/CBEC@CBEC 


Date: 09-07-2014 16:14 

Subject: Re: Draft Data Sharing Policy of CBEC 


The efforts that has gone into preparing the draft DSP is commend '^e. However, I would like to 
share mv thouqhts with others on certain issues mentioned in the draft DSP, 

(1) Para V 3- While categorization of personal/ individual data as highly sensitive' s 
undefendable, the distinction between sensitive and non-sens,t.ve is not so. Ini both cases 

sensitive) instead of three categories proposed. 


https://webmai 1. icegate. gov 


.in/mail/80001189.nsf/(%24Inbox)/4166FA77B666E62B65257... 8/21/2014 










Page 3 of 


(2) Para3: If the person and individual himself asks for his own data, it should be provided to him 
even though it is sensitive/highly sensitive. This can be done with a password/OTP or similar 
protection. This is similar to a credit card holder asking details of his own transaction. Besides 
bringing in transparency it may help the individual to detect his own/department's mistake in 
data feeding. 

(3) Para4: The draft DSP is not so clear about the access to data by private parties/institutions/ 
research scholars/analysts. Whatever data is categorized as non-sensitive, should made available 
in public domain ( say CBEC web-site) in defined format (i.e. what is considered to be of general 
interest) , suo moto. This would enhance the level of transparency of the department. In case 
non-sensitive data is asked for by a non-govt, agency on ad hoc basis or in non-standardized 
format, the same can be provided on charging 'processing charges'. This way EDW can become a 
profit-center as well. 

(4) Para 4.2 Table : Even if it is highly sensitive, denial of information to Parliament on being 
asked specifically, would invite 'Privilege Issue'. 

(5) Para 5 Does official e-mail id means those managed by govt, agency? If so what is so great 
about govt, run service provider. Are they more robust against hacking. Else when confidentiality 
clause is already put in MOU, why should we insist on govt run service providers only. We 
ourselves use private vendor for transmission of data. Why not allow the user/receiver to choose 
is e-mail id? 

These may sound rebellious but I feel the DSP should be guided more to 'share' than to 'hide'. 
Regards 

Gautam Bhattacharya 
.Vivek Chaturvedi/CBEC wrote:. 

To: Maninder Singh/CBEC@CBEC, debi dash/CBEC@CBEC, Gautam Bhattacharya/CBEC@CBEC, 
yogendra garg/CBEC@CBEC, Satendra Singh/CBEC@CBEC, Arti Srinivas/CBEC@CBEC 
From: Vivek Chaturvedi/CBEC 
Date: 07/03/2014 06:58PM 

Cc: Shubhagata Kumar/CBEC@CBEC, Bashistha Prasad/CBEC@CBEC, SK 

Vimalanathan/CBEC@CBEC 

Subject: Draft Data Sharing Policy of CBEC 


Dear All, 

Please find attached the first draft of the proposed data sharing policy of CBEC. DG Systems has 
desired that all teams within the Directorate of Systems may provide their valuable inputs and 
comments on this living document by next Friday, July 11, 2014 , so that a final view can evolve 
which would then be put up for consideration by the Board. 


Regards, 

Vivek Chaturvedi. 


/See attached file: CBEC Data Sharing Policy_v0.1.docx) 


[attachment "CBEC Data Sharing Policy_v0.1.docx" removed by Gautam Bhattacharya/CBEC] 
Attachments: 

comments Data sharing policy.docx 
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J 

i sharing policy 

. We °°« *-PP'V «n'V » POV .0 CBEC as a whole/ .0 comnnissionera.es 

also (DoS may deny data, while commissioner may allow) 

> Scope of the policy: Will it be applicable to data shared under CMAA, MoUs 

> Ownership of the data: The data is held by CBEC in a fiduciary capacity. However, w*hm 
CBEC- who owns it? For instance, whether the owner of the data generated on the customs 
side is the commissionerate/ DoS/ CBEC. This is relevant especially m the case of RT, 
whether the Commissionerates should decide whether data should be given or 1 os. 

> Restrirtion^nfurthe^ usage of data: The purpose or usage of the data may be sought from 

the receiving party . . , 

> Approval levels: Clearances required from whom- based on categorization/ u 

• National Data Sharing & Accessibility Policy. 

> Is this compliant with the NDSAP requirements 

> Do we need to dovetail it into NDSAP? 

> If so, we may consider using the same categorisation for data 

• Classification: 

> Shareable/ non- sharable 

- Negative list: Do we need to add a negative list, or does the highly-sensitive category 
suffice. Eg. Criteria for evaluation of Risk by RMS; intelligence; System architecture; 

design of an application 

■ Should it be subject to user category? 

C ' aS " lfV Raw data! ^NSDL- directories; CONCOR/ PQIS- CHA directories (NDSAP- data collected 
by one govt agency, is there a need for other govt agencies to collect & build the 

same??) 

■ Meta data- time stamp 

■ logic:- eg. Risk rules/ targets 

> Classify by ownership/ data creating agency:- 

■ Within CBEC 

. oGD data held by CBEC: data held on behalf of other Regulatory agencies eg. Licenc 
data(DGFT); BRC/ AD bank data(RBI); PGA data under Single Window will have 

significant issues- policy for this may be defined 

. category*^ ^ a for internationa , Data exchange? GNC/ AEO MRA? This is. 

naturally dependent on the scope of the policy, as mentioned above. Of course as the 
CMAAs/ MOUs with other administrations have already undergone the rigours of Home/ 

Law/Foreign Affairs, this may be redundant c .. 

> Parliament- agree with Shri Bhattacharya regarding denial. As it is, as case-by case scrutiny 
would anyway be in place, for the Policy we may change the matrix at 4.2. 

• In the list of users of DoS: CRIS can be added 

. Shall adhoc requests from private parties for their own/ non-sensitive data be allowed 
. Can we suo moto publish/ place in the public domain non-sensitive data, which is generated at 
cost of public funds, as required by the NDSAP? As suggested by Shri Bhattacharya, processing charg 
can be charged. There is already a legal provision under Levy of Fees (Customs Documen s) 

. Notdirectly rented to the DSP, but relevant in the context of DoS centrally holding the data: as per 
the legal requirement, (Publication of Daily Lists of Imports and Exports. 2004) commissioner shall 
publish Daily list of transactions in his jurisdiction, however in reality this is being done by Iceg , 
the commissioner has no means to do so. 
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From: Vivek Chaturvedi/CBEC 

To: Rahul SinhaPWC/CBEC@CBEC, Radhika Arorapwc/CBEC@CBEC 

Date: Friday, July 18, 2014 07:11PM 

Subject: fw: Comments on Data sharing policy 

History: + This message has been replied to. 


Forwarded by Vivek Chaturvedi/CBEC on 18-07-2014 19:23 


From: "MS Arora" <maninder.singh@icegate.gov.in> 

To: <Vivek.Chaturvedi@icegate.gov.in> 

Cc: <Ananya.Ray@icegate.gov.in>, <bashistha.prasad@icegate.gov.in>, 

<Arti Srinivas@icegate.gov.in>, <Satendra.Singh@icegate.gov.in>, 

<debi dash@icegate.gov.in>, <Gautam.Bhattacharya@icegate.gov.in>, <y.garg@mc.in> 

Date: 18-07-2014 16:31 

Subject: Comments on Data sharing policy 


Dear Sir/Madam, 

Comments on the captioned subject are attached. 

M S Arora 
ADG ICEGATE 

Directorate General of Systems 

(See attached file: Comments on Data Sharing Policy vl l.docx) 
Attachments: 

Comments on Data Sharing Policy vl l.docx 
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general O bservations 


s. No Page no. and Clause S 

"'omments 

i« the document 

i Esi J 

ngn nf the Department is old one 

-■—;- z ... .--nviH- rerl as i 0 and omvartl in 

2 ESI 

nf the document ma\ he ronsidereo as i.uau - 

pi are nf o.i onward 

3 ES -2 

riu nw nf the document mav he CBEC not DOS 

1 pH - 

rvu-nmcnt author rnav he DOS sinre data sharing ponc\ snail 
control all activities of information sertinU across the board. 

5^ Clause 2.1 ?ZLA 

r..rrent status contains a narrow new ot the scopp ot data sharing 

llt f-., t i-rihpre nf data sharing is ven’ wader, which 


ind.wWeal time data sharing npar real time dilUI sharing. P d Sl 

a *<1 c Wine RTI renlies. providing new to the information in data 

table through enquiries etc 

6 Clause 2.2 P& 5 

it mav be pmpha^d that the tradP nRTa a ^ aildU ' ^---, 

Ur proprietary importance for the owners of the information and 
it is needed to take due care to protect mteresiol 
i^^ndnak /firms. At same time trnde in ^ ormatlQn I s reqWSfl 


fii^rnt purposes in the larper public interest’ (data contents 
ii j iu„ nf affpnriM and its business 

mnet bp based on the ratygon oid^eMcica^i- 

rpniiirpmpnt nlus degree of public interest invoh edj 

^ w £ 4 r>%/ n*ivorc nic n cont 1 n 

~ Clause 2.2 P&Ji 

CRF.C holds indirect tax data of tax pa\ers, wmen cum_d_ 

-- .. _ _ _ 0 i crt Tbp enbipet information is captured 


nrnnnetarv components aiso. -- r 

L t Kc Henartment for statutory requirements CBF.C also holds 

n\ inc ucpai -- - . j • j* ’Junio 

data nertaini"f ♦« other Govl/Private af ennes and indmduajs 

lilrenr.FT POIS/FSSAI (on starting operation). IHA, etc. 

Hnu-pvpr for the business Drocesses, enforcement, gnahsis etc. or 

w c#>vpral nth- paeons, this information is required to be share 

tor Scl^l UUl^l 1 VVtvVMfl H IV • ... .j 1 riAT« 

with many Govt or private agencies an^mttl mrtiMtlualS- 
cV>onlH not nroclaim the data is held in Fiduciary capacip- ft? legal 

SnOUlQ not vfii- --‘ i 

hasis of this statement is not known. It mat es ns sublet to lesa. 

proceedings.) 

8 Clause 3^6 

~ In place “it is proposed ' there should he accordingly , Qinerem 

data components, mav be categorized into! 

—rrvu rntprrr ; 7 ot^r> not consider the category of users who arg 

Clause 4 . 2 _PgJ) 

i ne ( aiesiui i4n 1 iflaa - - . . 

cc partners of Customs f F.x. And S. TaxadmtmstratioiL 

Thev renuire Highly Sensitive data to complete the business 

processes. Further, with institiitionaliTation of Public-Pmaie 

_oroi rwt Mcti\-itieis requires suitable provisions 

partnerships in se\erai - - - . 

~ r charing Hiehlv Sensitive and Sensitive data wjtn such pnvale 
agencies who undertake Govt, functions and need such dataie 
fulfil their statntorv business requirement 

io. Clause no. 4.2, pg 9 

— The table defines details of external agencies that have access to 

different categories of data.-- -- 
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. The sharing of data with external agencies should not be 
based name of the agencies^but^but rather be defined 
based upon requirement & appropriate designation of the 
stakeholder in the external agency. 

• For each category of data a SPOC should be identified y 
the external agency and the same may be used for all 
communication for that category. 

• A different clearance level should be defined in the 
department, for each category of data. 

11. 

Clause no. 4 -t> Pg 8 

The table shows the details of users who have access to ditterent 
categories of data.Whereas users may have access to data, the 
same doesn’t mean that they have authority to share the same. The 
same should be clarified in document, whether any user with 
access can share that data also. 

12. 


A provision to have non-disclosnre agreement sin' e we ha*e 
incurp that thp nartv who received data shall not share any 

infnrmatinn with othpr agencies/ individuals which are Hs Q1 

sensitive in nature. 

!3i 


Srnpp of thp poliev must be defined. 

14* 


Authorization /notifications process tor the new users mum 

defined since it requires establishing standard protocol 

!iL 


■ a Clear mode of data sharing and its security should be defined 
hased upon the sensitivity of data. 

16 , 


Tprms u«5pd in the document m a\ he defined at the b^uming 


Technical Suggestions : 


S. No 

Clause in 
thedocument 

Comments 

1 

Clause no. 4 - 2 , pg io 

• Proper verification of details of server from which email 
request to share data is received should be done, to 
address challenge of receiving deceitful request from 
domains like fakesend.com, deadfake.com etc ( a user can 
enter any email id in “to” & “from ’ field of the email in 
such applications) 

• Only those data request should be accepted which are 
received from users who are within the geography of the 
country. 

• While sharing the data through SFTP also the IP address 
of the user should be verified so as to ascertain that it 
originates from India. 

2 

Clause no. 5.3, pg 11 

• The official email id of the user should be regularly verified 

before share the data with them over email. 

• IP address based mapping should be done before sharing 

any data. - 






























































3 

Clause no. 5.3, pg 11 

• Signing / not-signing of MOU should not be based upon 
the frequency of data sharing, but should rather be linked 
to criticality of the data. 

• While signing MOU it should be ascertained that MoU 
shall consider 

0 Data Storage 

0 Data Handing/Processing 

0 Data Transmission 

0 Data Destroy/Dispose 

• For more critical data an Agreement may be considered 
instead of MOU. 

• Non-Disclosure agreement (NDA) of data may also be 
included as part of MOU/ agreement 


ik iii. A dditional Technical Suggestions: 


S. No 

Suggestion 

1 

A detailed architecture of data sharing platform may be included m the document. The 

architecture should preferably be SOA based, for better manageability and end user 
experience. 

2 

The data sharing platform should be hosted on standalone hardware for greater security. The 
details of the hardware platform may also be included in the document. 

3 

A detailed chain of command may be included in the policy document. A responsibility 
matrix should also be defined which clearly delegate responsibilities on stake holders who 
will manage data sharing. 

4 

The data sharing policy should also define timelines which should be adhered to, while 
sharing the data forall the requests which are received by the Department. 

5 

End user verification may also be included as part of data sharing policy and mere emails 
should not be trusted as authentication medium. 

6 

The policy should also mention that the data shared by the Department will not be used for 
any commercial purpose. 

7 

Data dissemination trail should be properly logged in the system so as to keep details of the 
record of the data shared with different users. 

8 

Policy should also cover modalities on sharing of data though hard copies 

9 

Data shared over email should be password protected 

10 

Exception conditions to the data sharing policy may be included in the document, lhe 

exception conditions may need approval from appropriate authorities. 










































File No 206/03/2014-CX-6, 
Government of India, 

Ministry of Finance, 
Department of Revenue, 
Central Board of Excise and Customs, 
New Delhi. 




The Director General, 

Systems and Data Management, 
4 th and 5 th Floor, Hotel Samrat, 
Chanakyapuri, 

New Deihi. 


•••. SyStCTDE & 0.6* 

Dimrjr WO— 

Dt.:24.04.14 

BP 


Sub: Meeting regarding formation of Audit Commissionerates and Revised 
Audit norms - reg. 

Sir, 

I am directed to forward a copy of the minutes of the meeting held in the 
Office of the Chairperson on 11.03.14 on the above mentioned subject. You are 
requested to kindly peruse the minutes and forward a proposal to the Board 
suggesting the legal and technical protocols to be followed for maintaining 
confidentiality of the third party information and the procedure for dissemination of 
the information to various departmental users, as the third party information would be 
an important input for risk based selection of units for conducting audit. This would 
lead to formulation of a clear data sharing policy in CBEC. 


Enel: 5 pages. 



Director - CX 1/6 




nrm , ITPQ n p thf MEETING HELD on 11/03/2014 ON THE ROLE & FUNCTIONS 

Tr, r |- i r y — PROPOSED 

THE CADRE RESTRUCTURING 

A meeting was held by Ms, J.M. Shanti Sundharam, Chairperson, CBEC on 
11 03 14 to discuss the role & functions of the exclusive Audit Commissionerates 
proposed °set up in the cadre restructuring Following other Officers were 

present at the meeting: 


Mamp of the Officer 

Designation 

Mo i irvi i/o Rnv Maiumdar Choudhary 

Member(Sevice Tax) 

IVIS LlUllSd rxvjy iviajui i iuwi i - 

Rh Shashi Bhushan Singh 

Member (Excise) 

Sh H K Jain 

DG Audit 

Sh Satva L. Srinivas 

ADG Audit (Hq.) 

Sh D P Naaendra Kumar 

ADG Audit (Bangalore) 

Rh Aiav Jain 

Commissioner-CX (CBEC) 

Sh S M Tata 

Commissioner-C l (Cbtc) 

Sh M K Sinha 

Director CX-1/6 

Sh. B.B. Gupta 

OSD to Chairperson 


2 Audit plays a major role in compliance verification in the self-assessment 
regime Considering its importance, the Cabinet has approved the setting up of Audit 
Colissionerates in the cadre restructuring of CBEC to exclusively eaw,th the 
audit functions in Customs, Central Excise and Service Tax. As setting up of 
exclusive Audit Commissionerates involves a major organisational restructuring in 
the field, the following issues which have a bearing on its smooth funrtiomng were 
discussed in the meeting. The decisions taken in the meeting are as follow . 


3. Administration Issues: , 

(i) Audit Commissionerate may be set up as a functional vertical within a 
Customs Central Excise, Sernce Tax or an integrated zone reporting to the 
jurisdictional Chief Commissioner. Administratively, the Audit Commissionera e 
should be financially and functionally independent sinmar tc> an Execute 

Commissionerate: the Commissioner (Audit) may e prov Department' 

budget, administrative and financial powers including that of Head of Department 

(HOD). 

(ii) Officers posted to Audit Commissionerates should have all India legal 
jurisdictions. Functional jurisdiction may be prescribed by the Board for specif 
geographical territory. 

(iii) A standard internal structure should be adopted by each Audit 
Commissionerate with functional units such as Hqrs.,Planning Cell, Follow-up Cell, 
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Audit Divisions/Circles, Audit Groups, etc. The number of Audit Divisions/Circles, 
Audit Groups within an Audit Commissionerate including their location may be 
decided by the jurisdictional Principal Chief/Chief Commissioner based on the 
guidelines laid down by the Board/DG (Audit). 

(iv) The Audit Divisions/Circles, Audit Groups should be organised either on 
territorial or functional basis. In metropolitan cities, specialised Audit 
Divisions/Circles, Audit Groups may be created on functional basis to deal with 
specific industry/service sectors. In other areas such Divisions, Audit Groups may 

be organised on territorial basis or taxpayer segmentation to achieve maximum 
efficiency. 

(v) As audit is a specialised function requiring certain skill sets and domain 
knowledge, a minimum tenure of three years may be prescribed for officers posted in 

Audit Commissionerates. For trained CAAP auditors, the minimum tenure shall be 
five years. 

(vi) On administrative grounds or in case of exigency, the tenure could be reduced/ 
extended by the competent authority. 

4. Technical Issues: 

(i) On the issue as to who would convene the audit Monitoring Committee 
Meeting (MCM), it was decided that it shall be the responsibility of the Commissioner 
(Audit) to convene such meetings where the Commissioner (Executive) or his 
Representatives will be invited to attend. Decision making with regard to settlement 
of audit objections after recovery of all dues or dropping of the unsustainable audit 
objections shall vest with the Commissioner (Audit). Approved audit objections 
including those in which show cause notices are proposed should be conveyed to 
the Commissioner (Executive) who shall respond to these objections conveying his* 
agreement/disagreement within 30 days of the receipt of the minutes of the MCM. 
On point of differences, further consultations may be held for a maximum period of 
15 days. In case difference persists, the final decision to issue show cause notice or 
not, shall rest with the Commissioner (Audit). 

(ii) On the issue as to who will issue the show cause notice, it was decided after 
deliberation that the Commissioner (Audit) shall be responsible for issuing show 
cause notice making it answerable to the jurisdictional 
Commissioner(Executive)/subordinate authorities. Audit function will end with issue 
of show cause notice and further action including adjudication and follow-up shall be 
the responsibility of the Commissioner (Executive). 

(m) Litigation after adjudication proceedings including defending the. order before 
the appellate forums (Commissioner (Appealsj/Tribunals/Courts) shall be the 
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responsibility of the Commissioner (Executive). However, audit shall remain closely 
associated and provide inputs wherever required. 

(iv) Currently, audit is undertaken for each tax separately even though the 
business and financial records verified during such audit remains common for all the 
three taxes administered by CBEC. The issue regarding whether audit should be 
carried out in an integrated manner to cover Central Excise, Service Tax and 
Customs (On Site Post Clearance Audit) was discussed and it was decided that an 
integrated audit may be undertaken covering Central Excise, Service Tax and 
OSPCA to improve efficiency in audit process. Within a zone where an assessee 
has registration both under Central Excise and Service Tax (common PAN), they 
could be assigned to a particular Audit Commissionerate depending on which of the 
two taxes has been discharged at higher proportion in the previous financial year, to 
avoid overlap in jurisdiction. 

(v) The issue regarding creation of separate Audit Commissionerate for auditing 
taxpayers assessed in the jurisdiction of Large Taxpayers Units (LTUs) was 
discussed in the meeting. In view of the single window concept followed in LTUs, it 
was decided to create two exclusive Audit Commissionerates to deal with the audit 
of large taxpayers assessed in LTUs. 

(vi) On the issue regarding creation of independent Audit Commissionerate for 
Post Clearance Audit (PCA) of Customs clearances, it was decided that at least two 
Commissionerates may be set up initially one each at Mumbai and Chennai. 

(vii) To improve co-ordination in OSPCA audits between the Commissioner (Audit) 
and the jurisdictional Commissioner of Customs, it was decided that the co¬ 
ordination mechanism envisaged in the case of Central Excise & Service Tax audits 
discussed above could be applied for OSPCA audits as well. 

* 

(viii) With regard to pre/post audit of rebate, refund & brand rate fixation 
(drawback), it was decided that such functions may continue to be performed by the 
Commissioner (Executive). 

(ix) On the role of Audit Commissionerate regarding compilation of information for 
CERA and replying to the audit objections raised by C & AG, it was decided that the 
Commissioner (Audit) will have no role either in compiling/furnishing information to 
the CERA or replying to the C & AG objection. However, it is desirable that the Audit 
Commissionerates are aware of objections raised by the C & AG. Therefore, copy of 
objections received from CERA and replies furnished by the Commissioner 
(Executive) shall be forwarded to the Commissioner (Audit) for information. 

(x) Sec.14A/14AA of Central Excise Act, 1944 and Sec.72 of Finance Act, 1994 
provide for Special Audits in specified circumstances through Cost 
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Accountants/Chartered Accountants. It was decided that the Commissioner (Audit) 
either on his/her own satisfaction, or on reference received from the Commissioner 
(Executive) would be the competent authority to order for Special Audit under the 
aforementioned provisions. 

(xi) Meeting also discussed the difference between detailed scrutiny of returns 
undertaken by the jurisdictional officers and conduct of audit by the officers of Audit 
Commissionerate. It was decided while the scrutiny of returns shall be the 

responsibility of the Commissioner (Executive), audit functions shall be carried out bv 
the Commissioner (Audit). 

(xii) . The powers of the departmental officers to conduct taxpayer audit (under 
Service i ax & Central Excise) has been challenged before various High Courts and 
few adverse orders have been passed in the recent past. After deliberations, it was 
decided that for clarity, amendments may be carried out in the Central Excise Act, 
the Finance Act and the Customs Act, clearly specifying the powers of the 
departmental officers to undertake taxpayer audits. The DG (Audit) shall forward 
necessary proposals in this regard to the policy wings of the CBEC for carryinq out 
the amendments. 


(xiii) The issue regarding prescribing a Tax Audit Report similar to the provisions 
contained in the Income Tax Act, 1961 and various State VAT laws was discussed in 
the meeting. The existing Annual Returns in Central Excise need a relook to carry 
out effective scrutiny and audit. In Service Tax, there are no such returns prescribed 
as on date. There is a need to reconcile the financial information contained in the 
Annual Financial Statement of the company (Balance Sheet) with the Tax Returns 
filed with the department. This would help the departmental officers to carry out the 
scrutiny/audit functions more effectively. It was accordingly decided to prescribe 
either a Tax Audit Report or Annual Financial Return, similar to the provisions 
existing in other tax laws in the country. This may be prescribed uniformly for all' 
taxpayers whose annual turnover exceeds a prescribed threshold. 

Revision of Audit Norms: 

5 . In the meeting, the proposal received from the DG (Audit) regarding revision 
of norms for conducting audit was discussed. The proposal includes (i) calibrating 
the audit coverage with availability of manpower, (ii) selection of units for audit based 
on multiple parameters such as those derived from ACES, past detections in audit 
.3rd. party information, etc. (selection of units based on risk) (iii) classification of 
assessees into Large, Medium and Small on the basis of value of clearance instead 
of duty payment, (iv) prescribing frequency of audits for each category of assessees, 
(v) provide guidelines on composition of team and number of days needed for 
conducting audit, (vi) introducing three tier audit which are theme based / issue 
based and coordinated audit, (vii) use of EDW and third party information for 
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identifying theme for the audit, (viii) integrated audit combining Central Excise, 
Service tax and Customs, (ix) accredited status for select assessees for deferring 
frequency of audit. 

6. While broadly agreeing to the proposals made by the DG (Audit), it was 
decided that in the light of the decisions taken in the meeting, the DG (Audit) shall 
prepare a fresh proposal and forward the same to the Board for consideration. The 
following points may be noted in this connection, 

(a) Currently the risk parameters for selecting the document for PCA are being 
selected locally based on local factors alone. DG (Audit) will be required to 
work out the risk parameters for selection of BE/SB’s for PCA. 

(b) Currently the Risk Assessment in RMS is largely based on the transaction 
document alone, and targets are also inserted by DRI/ Local Committees. 
Since Risk assessment should be based on all documents connected to 
BE/SB, as also an entity analysis, there is a need to broad base the selection 
of risk parameters for RMS. DG (Audit) should therefore, play an active role in 
this regard. 

(c) In the case of ACES, while the preliminary scrutiny will continue to be done by 
the system. Identification of risk parameters for selection of units for Manual 
Scrutiny is the jurisdiction of the DG (Audit). Since Detailed Manual Scrutiny is 
like a mini Audit of the entity (and not just the return), DG (Audit) should also 
specify the slab wise risks and the slabs which would be covered by Audit 
Committee and those to be covered by Ranges. 

7. Principal Chief/Chief Commissioners may continue the audits based on the 
existing norms prescribed in the audit manuals and circulars issued on the subject, 
till such time the new norms are put in place,. Board may further authorise them to,, 
issue instructions for removal of difficulties in carrying out audit with the existing 
norms to be applicable within their respective jurisdictions. 

3 rd Party information: 

7. As third party information would be an important input for risk based selection 
of units for conducting audit, DG (Audit) may forward a proposal to the Board on the 
third party data specifically required and also the legislative amendments required to 
gather such third party information. 

8. DG (Systems) will suggest the legal and technical protocols to be followed for 
use of third party information. DG (Systems) will also forward the draft data sharing 
policy for the CBEC, for immediate consideration of the Board. 
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1. Preamble 

1.1 Asset and value potentials of data are widely recognized at all levels. Data 
collected or developed through public investments, when made publicly available 
and maintained over time, their potential value could be more fully realized. 
There has been an increasing demand by the community, that such data collected 
with the deployment of public funds should be made more readily available to all, 
for enabling rational debate, better decision making and use in meeting civil 
society needs. Principle 10 of the United Nations Declaration on Environment 
and Development (Rio de janeiro, June 1992), stated 

“. each individual shall have appropriate access to 

information concerning the environment that is held by public 

authorities . and the opportunity to participate in the decision 

making process. States shall facilitate and encourage public 
awareness and participation by making information widely 
available. ” 

Section 4(2) of the Right to Information Act, 2005 reads 

“It shall be a constant endeavor of every public authority to take 
steps in accordance with the requirements of clause (b) of sub¬ 
section (1) to provide as much information suo motu to the public 
at regular intervals through various means of communication, 
including internet, so that the public have minimum resort to the 
use of this Act to obtain information” 

1.2 The principles on which data sharing and accessibility need to be based include: 
Openness, Flexibility, Transparency, Legal Conformity, Protection of Intellectual 
Property, Formal Responsibility, Professionalism, Standards, Interoperability, 
Quality, Security, Efficiency, Accountability, Sustainability and Privacy. 

1.3 A large quantum of data generated using public funds by various 
organizations and institutions in the country remains inaccessible to civil society, 
although most of such data may be non-sensitive in nature and could be used by 
public for scientific, economic and developmental purposes. The National Data 
Sharing and Accessibility Policy (NDSAP) is designed so as to apply to all 
sharable non-sensitive data available either in digital or analog forms but 
generated using public funds by various Ministries / Departments /Subordinate 
offices / organizations / agencies of Government of India. The NDSAP policy is 







designed to promote data sharing and enable access to Government of India 

owned data for national planning and development. 

2. Definitions 

2.1 Data- Data means a representation of information, numerical compilations 
and observations, documents, facts, maps, images, charts, tables and 
figures, concepts in digital and/or analog form. 

2.2 Data Archive - A place where machine-readable data are acquired, 
manipulated, documented, and distributed to others for further analysis 
and consumption. 

2.3 Data Generation - Initial generation / collection of data or subsequent 
addition of data to the same specification. 

2.4 Data set - A named collection of logically related features including 
processed data or information. 

2.5 Geospatial Data - All data which is geographically referenced 

2.6 Information - Processed data 

2.7 Metadata - The information that describes the data source and the time, 
place, and conditions under which the data were created. Metadata informs 
the user of who, when, what, where, why, and how data were generated. 
Metadata allows the data to be traced to a known origin and know quality. 

2.8 Negative list - Non sharable data as declared by the departments / 
organizations 

2.9 Restricted Data - Data which are accessible only through a prescribed 
process of registration and authorization by respective departments / 
organizations. 

2.10 Sensitive data -Sensitive data as defined in various Acts and rules of the 
Government of India. 

2.11 Sharable data- Those data not covered under the scope of negative list 
and non-sensitive in nature 

2.12 Standards - Any application that embeds data handling functions (e.g.. 
data collection, management, transfer, integration, publication, etc.) and 
operates on data in a manner that complies with data format and data 
syntax specifications produced and maintained by open, standards bodies. 


3. Need for the Policy 

Evidence-based Planning of socio-economic development processes rely 
on quality data. Ihere is a general need to facilitate sharing and utilization of the 
large amount of data generated and residing among the entities of the Government 
of India. This would call for a policy to leverage these data assets which are 
disparate. The current regime of data management does not enable open sharing 
of Government owned data with other arms of the government nor does it expect 
proactive disclosure of sharable data available with data owners Such regimes 
could lead to duplication of efforts and loss of efficiency of planning of activities 
focused on national development. Efficient sharing of data among data owners 
and inter and intra governmental agencies and with public calls for data standards 
and interoperable systems. Hence, National Data Sharing and Access Policy aims 
to provide an enabling provision and platform for providing proactive and open 
access to the data generated through public funds available with various 
departments / organizations of Government of India. 

4. Objectives 


The objective of this policy is to facilitate the access to Government of 
India owned shareable data and information in both human readable and machine 
readable forms through a network all over th rcouhtry~7frii~TTfoaclrv^-ainf 
periodically updatable manner, within the framework of various related policies 
Acts and rules of Government of India, thereby permitting a wider accessibility 
and use of public data and information. 


5. Scope of this Policy 

The National Data Sharing and Accessibility Policy will apply to all data 
and information created, generated, collected and archived using public funds 
provided by Government of India directly or through authorized agencies by 
vanous Ministries / Departments /Organizations / Agencies and Autonomous 


6. Benefits of the data sharing policy 

6.1 Maximising use: Ready access to government owned data will enable 
more extensive use of a valuable public resource for the benefit of the 
community. 

6.2 Avoiding duplication: By sharing data the need for separate bodies to 

collect the same data will be avoided resulting in significant cost savings 
in data collection. 6 

6.3 Maximised integration: By adopting common standards for the collection 
and transfer of data, integration of individual data sets may be feasible. 







6.4 Ownership information: The identification of owners for the principal data 

sets provide information to users to identify those responsible for 
implementation of prioritized data collection programs and development 
of data standards. 

6.5 Better decision-making: Data and information facilitates making 
important decisions without incurring repetitive costs. Ready access to 
existing valuable data is essential for many decision making tasks such as 
protecting the environment, development planning, managing assets, 
improving living conditions, national security and controlling disasters. 

6.6 Equity of access: A more open data transfer policy ensures better access to 

all bonafide users. 


7. Data Classification 

Different types of data sets generated both in geospatial and non-spatial form by 
different ministries /departments are to be classified as shareable data and non shareable 
data. The types of data produced by a statistical system consist of derived statistics like 
national accounts statistics, indicators like price index, data bases from census and 
surveys. The geospatial data however, consists primarily of satellite data, maps, etc. In 
such a system, it becomes important to maintain standards in respect of metadata, data 
layout and data access policy. All departments / ministries will prepare the negative list 
within six months of the notification of the policy, which will be periodically reviewed 
by the oversight committee. 


8. Types of Access 

8.1 Open Access 

Access to data generated from public funding should be easy, timely, user- 
friendly and web-based without any process of registration / authorization. 

8.2 Registered Access 

Data sets which are accessible only through a prescribed process of 
registration / authorization by respective departments / organizations will 
be available to the recognized institutions / organizations / public users, 
through defined procedures. 

8.3. Restricted Access 

Data declared as restricted, by Government of India policies, will be 
accessible only through and under authorization. 


9. Technology for sharing and access 

A state-of-the-art data warehouse and data archive with online analytical 
processing (OLAP) capabilities, which includes providing, a multi-dimensional 
and subject oriented view of the database needs to be created. This integrated 
repository of data portals of various ministries / departments as a part of 
data.gov.in, will hold data and this repository over a period of time will also 
encompass data generated by various State Governments and UTs. The main 
features of the data warehouse need to include: 


(a) User friendly interface 

(b) Dynamic / pull down menus 

(c) Search based Report 

(d) Secured web access 

(e) Bulletin board 

(f) Complete Metadata 

(g) Parametric and Dynamic report in exportable format 

10. Legal framework 

Data will remain the property of the agency/department/ ministry/ entity which 
collected them and reside in their IT enabled facility for sharing and providing access. 
Access to data under this policy will not be in violation of any Acts and rules of the 
Government of India in force. Legal framework of this policy will be aligned with 
various Acts and rules covering the data. 

11. Pricing 

Pricing of data, if any, would be decided by the data owners and as per the 
government policies. All Ministries / Departments will upload the pricing policy 
of the data under registered and restricted access within three months of the 
notification of the policy. A broad set of parameters would be standardized and 
provided as guidelines for the use of data owners. 

12. Implementation 

a) The Department of Science & Technology serving the nodal functions 
of coordination and monitoring of policy through close collaboration 
with all Central Ministries and the Department of Information 
Technology by creating data.gov.in through National Informatics 
Centre (NIC). 

b) All sharable data will be made available on ‘as-is where-is’ basis. 


c) Detailed implementation guidelines including the technology and 
standards for data and metadata would be brought out by Department 
of Information Technology, Government of India. 

d) All the data users who are accessing / using the data shall acknowledge 
the ministry / department in all forms of publications. 

e) All Ministries/Departments will upload at least 5 high value data sets 
on data.gov.in within three months of the notification of the policy. 

f) Uploading of all remaining data sets should be completed within one 
year 

g) Thereafter, all data sets are to be uploaded regularly every quarter. 

h) data.gov.in will have the metadata and data itself and will be accessed 
from the portals of the departments/ministries. 

i) The metadata in standardized formats is to be ported on data.gov.in 
which enables data discovery and access through departmental portals. 
All metadata will follow standards and will minimally contain 
adequate information on proper citation, access, contact information, 
and discovery. Complete information including methods, structure, 
semantics, and quality control/assurance is expected for most datasets. 

j) Government will design and position a suitable budgetary incentive 
system for data owners for increasing open access to the sharable 
data. 

k) An oversight committee will be constituted for facilitating the 
implementation of the policy and its provisions thereof 

l) Department of Information Technology will constitute a coordination 
committee for implementation. 

13. Budget Provisions 

The implementation of National Data Sharing and Access Policy is 
expected to entail expenditures for both data owners and data managers for analog 
to digital conversion, data refinement, data storage, quality up-gradation etc. 
Budgetary provisions and appropriate support for data management for each 
department / organization by Government of India would be necessary. 









14. Conclusion 




14 1 While policies provide official mandate, facilitation ot optimum 
accessibility and usability of data by the implemented pre-suppose a 
trajectory of proper organisation of data, with access services and 
analysis tools that provide the researchers and stakeholders with added 
value. For data to be reused, it needs to be adequately described and 
linked to services that disseminate the data to other researchers and 
stakeholders. The current methods of storing data are as diverse as the 
disciplines that generate it. It is necessary to develop institutional 
repositories, data centers on domain and national levels that all methods ot 
storing and sharing have to exist within the specific infrastructure to 
enable all users to access and use it. 

14.2. National Data Sharing and Access Policy aims at the promotion of a 
technology-based culture of data management as well as data sharing and 
access. It opens up, proactively, information on available data, which 
could be shared with civil society for developmental purposes, their price 
details if any, and methods for gaining access to registered and restricted 
use. The policy has limited its scope to data owned by the agencies, 
departments/ Ministries and entities under the Government of India and 
forms a statement of the Government of India of its commitment to 
transparency and efficiency in governance. Department of Science & 
Technology will continue the process of evolving the policy further, 
keeping in tune with technological advancements and the National 
requirements and enrolling the State Governments. 
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NckNPJD MS/11/1431/2008 
Government of India 
Ministry of Science &. Technology' 
Department of Science & Technology' 
• (MRDMS Division) 



Teclmology Bhavan, 
New Mehrauli Road. 
New Delhi. 110016 

Dated: the 14 U: July 2010 

OFFTCK TVTFMQRANDUM 


Subject: National Policy for Data Sharing and Accessibility 



Large volumes and different types of data are generated and complied by various 
government departments / organizations for meeting their specific requirements, iviosl 
of the data / information collected at huge cost, with the taxpayers money coulo be 
made available to the general public by placing it in the public domain for access to 
improve the country's economic growth and better planning. 

v ^ 2 . Accordingly, the matter has been considered by the Cabinei in its meeting held 
/on June 10, 2010 and it has been decided to evolve a "National Policy for Data Sharing 
v^and Accessibility"; The said policy would be evolved within the following broad 
parameters approved by the Government :- 

The Department of Science & Technology (DST) would be the nodal Department 
for all matters connected with overall coordination, formulation, implementation 
and monitoring of the policy. Subject to this, each Ministry / Department of 
Government would be the nodal Department for implementation oi ihe policy 
relating to that Ministry / Department as well as their autonomous / statuary 
bodies and sub-ordinate offices. 


This policy shall apply to all non-ciassified / non-sensitive data collected .using 
public funds and held by various Ministries / Departments (including their sub¬ 
ordinate offices, and autonomous / statutory bodies) etc. 

All Ministries / Departments of the Government of India, would, within six months 
. A of approval of the Cabinet, classify their data into (a) sensitive, and (b) non- 
sensitive, keeping in view the national security consideration. To the extent 
possible,' classification wouid be feature based rather than geographical area 
cNbased. 
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(xiv) The Ministries / Departments of Government of India shall, while releasing funds 
to State Governments / other institutions of State Government, including state 
and central universities, under different schemes / programmes put down a 
condition that data generated using such funds would be governed by this policy. 

3. DST would, Keeping in view the 'detailed policy framework’ prepared by various 
Ministries / Departments finalize the detailed policy document on National Policy for 
Data Sharing and Accessibility and place it before the Cabinet for final approval. 

4. . Accordingly, all ministries / departments are reguested to take necessary action 
to implement the above said decision of the Cabinet and _prepare a detailed policy 
framework on Data Sharing and Accessibility with regard to their ministries / 
~deparfments (including their sub-ordinate offices, autonomous / statutory bodies etc ) 
^eping in view with the broad parameters approved by the Cabinet and send it to DST 
within a period of .three months to enable this Department to finalize the detailed policy 
document on National Policy for Data Sharing and Accessibility and place it before the 
Cabinet for final approval. 


) \ r C 

(Drlrider Jit Singh) 
Joint Secretary to the Government of India 


The Secretary 

All Ministries / Departments of Government of India 


V^_i/va.E. Cjv- 'j 
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Technology Bhavan, New Mehrauli Road, 

New Delhi-110016 
f/) Dated the 26 November, 2010 


office memorandum 
Subject: National Data Sharing and Accessibility Policy (NDSAP). 

w *M A ^ mter ' miniStenal meeting under the Chairmanship of Shri Prithviraj Chavan 

06 09 ° /C) ,0f SCfenCe & TeChn0 '°^ * Earth lienees was he,d o"' 

.09 2 010 to discuss various aspects of formulation of detailed policy frame work bv 

Mimstnes/Departments, basic elements to be shared with them, preparation of final draft 

of National Policy and such related matters. ‘on ornnai draft 

f: ena J ri h ® “ ° f * he ab ° Ve Said meeti "9 alon 9 with the background paper 
prepared for the meeting is enclosed to all ministries/departments for taking P into 

aqcount while formulating the detailed policy framework. ™r taking into 

J , The Ministries/Departments are requested to kindly take urgent necessary action 
the detailed Policy Cumen^" * & (DST) for f “ ° f 



Enel : As above. 


Deputy Secretary to the 
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Government of India 
Telefax: 26182973 


The Secretary 

All Ministries/Departments of Govt, of India 
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Minutes of the Inter-ministerial meeting on National Data 
Sharing and Accessibility Policy (NDSAP) held on 6/9/2010 in 
Anusandhan Bhawan, Rafi Marg, New Delhi. 

List of the participants is given in Annexure-I 

Secretary, DST welcomed the participants and apprised the 
participants about background in which the National Data Sharing and 
Accessibility Policy (NDSAP) is being formulated. The Cabinet has approved 
that NDSAP could be developed within a period of six months. The important 
aspect of this policy is to address the larger issue of data sharing among 
various Ministries /Departments and access for various civil society 
applications. He enlisted the various directions of the Cabinet including tasks 
assigned to DST. For geospatial data, existing NSDI mechanism with DOS and 
DST as co-chair could be utilized for conflict resolution. Secretary, DST 
suggested that some working groups may be formulated for developing the 
policy framework. 



2. Hon’ble Minister S&T and ES (1C) also welcomed all the participants. 

He requested all the Ministries /Departments to draw a comprehensive draft 
on NDSAP. He stressed the need for drawing the negative list of data by each 
department which is not sharable. This exercise will help to finalise the draft I 
policy for the consideration of the Cabinet. Data being generated with public 
funds should be made available to air the stake holders for use. All the 
departments should classify the data which can be shared with other 
j departments as well as with general public and also draw a clear list of ' • 
I negative data sets which can not be shared with anybody, Department of 
i Science & Technology has been assigned the responsibility to coordinate the 
drafting of policy on NDSAP. He also felt that creation of metadata, converting 
analogue in digital domain, adopting standards for ensuring interoperability 
and cost recovery models for value added product need specific attention. 
There is a need to study the international best practices and the global 
scenario while evolving the NDSAP. To draw comprehensive policy, working 
groups as proposed by Secretary, DST are very important to look into various 
aspects and draw comprehensive action plan. 
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' 3. A detailed presentation was made by the Secretary DST on NDSAP 
covering current data management regimes, what issues it will address, 
classification of data sets, what could constitute negative list, technology 
issues, managerial and institutional issues, financial /legal issues, broad 
principle under which NDSAP needs to be formulated.- 

4. During general discussion, Secretary, Ministry of Earth Sciences, 
informed that all the meteorological and ocean data is available on website. 
Only subsurface especially temperature profile in EEZ is restricted as per the 
present policy of the Government He was of the opinion that inter¬ 
departmental data sharing should be made more accessible. 

5. Secretary, DOS, informed that Remote Sensing and Image Data Policy 
is already available and accordingly data is being shared between Government 
departments. A complete list of negative data i.e. data which cannot be 
shared with anyone; data that can be shared with Govt, departments with 
certain restrictions and data which can be shared with general public, needs to 
be drawn up. 

6. Representative from Ministry of Statistics informed that they do not 
have any negative list of data. Very nominal cost is kept for data to be given to 
the users. 

r . 

7. Secretary, Border Management, Ministry of Home Affairs informed that 
a detailed exercise was already going on in the Ministry to classify the data. 
He indicated that substantial amount of statistical data/information was already 
on the websites of MHA and subordinate organizations. As such, any exercise 
in regard to a negative data list would need to go through the test of sensitivity 
and national security concerns, therefore, the aim would be to identify the 
data which can be shared including those under the RTI Act. 
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8. Representative from Ministry of Defence informed that list of vital 
areas/ vital points have already been finalized and being shared with Survey of 

India. As per the requirement, Defence Ministry will work out further details 
about the negative list of data. 



9. Representative from Ministry of Water Resources informed that data 
on Ganga Basin, Brahmaputra Basin and Barrack Basin is restricted. 
However, for specific needs, it could be shared amongst the Government 
agencies. 

10. Representatives from Ministry of Mines informed that Geological 
Survey of India which is premier agency to generate geological data has 
already developed a comprehensive geo-portal and all the reports' and maps 
are open for use. 


11. Representative of HRD Ministry informed that all the data on 
certificates, copy rights, degrees, list of publications etc. was being 
computerized and can be shared with the general public. However, archival 
poiicy need to be developed. 

12. Surveyor General of India recommended that features of map policy 
and imagery policy required to be harmonized. 

13. Representative of Census of India informed that as per the Restricted 
Policy Act, 1948, some of the census data is partially restricted. However, 
most of the data is in public domain and can be used. 


14. Based on the detailed deliberations, the following decisions were 
taken : 

j (a) All the concerned Ministries/Departments will prepare negative list 
of data within three months. (Action: All concerned departments/ 
I ministries) 
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(b) All the Ministries / Departments are requested to prepare their 
metadata and also provide this on the data portal specifically 
being created for this purpose. 

(c) The following five working groups are constituted. Details of 
composition and TOR will be finalized by DST (Action : DST) 

(i) Data classification 

(ii) Technology for Sharing and Access 

(iii) Global best practices for data standards 

(iv) NDSAP in the current legal framework 

(v) Costing and Pricing policy 

Meeting ended with Vote of Thanks given by Joint Secretary, DST 
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Background Paper 
for formulation of 

National Data Sharing and Accessibility Policy (NDSAP) 


1, CLASSIFICATION OF DATA 

Definition paradigm. Data and Information have gained high significance for 
developmental planning in knowledge societies. Civil societies seek open access to 
such daia and information generated with public funds for planning developmental 
processes. On the other hand, defence sensitivity requirements demand the restriction 
0l access an d availability of sensitive data. With growing levels of terrorism and the 
powerful use or technologies by non-state actors, providing free access to data and 
information is a challenge faced by Nation States. 

National Data Sharing and Accessibility Policy of India envisages a migration from one 
paradigm to^ another. ihe current classification of data of sharing is based on “Open 
Series Data model. In this process, any data not specifically included in the “Open 
Series Dataset 11 remains inaccessible for public use. 

i he Government of India has accorded approval to ihe changed paradigm of migrating 
towards Negative List of data rather than definition of an open Data Series Model 


Such Negative Lists could be based on features rather than nature and type. 

Classincation or Data based on feature and negative list for exclusion is the new 
paradigm. 

Delta owners and sources may therefore need to define and classify their data based on 

features and exclusion principle 1 for preparing a negative list within a defined time 
frame. 

For Geo-spatial data, ihe current mechanism of NSDI (jointly managed by DST and 
DoS) and for other types, DST will serve as a Nodal Point. 

Technical issues: Primary data generated by various agencies and sources become 
useful ior the Civil Society needs only after value additions and generation of meta data. 
Continuous updating of data is also a necessity. For example, National Remote 
Sensing Imagery Data at a resolution of 1M may provide an accuracy level of 2 M. On 
the other hand, map products of SOI provide an accuracy level of 12.5 Meter at 1:50,000 
resolution. ^ Data generated by SOI enjoy the merit of Ground truthing and high 
reliability. In order to harmonize resolutions of map products with the accuracy and 
iesolution of imagery policy, SOI may need to gather map data at a resolution of 1:8000. 
These is a technical issue in updating such data infrastructure. Further, in order to 
implement the National Data Sharing and Accessibility Policy standardization and inter¬ 
operability issues as well as digitization of legacy data are essential. 

Such infrastructure requirements call for strategic alliances and partnerships between 
primary data producers and other service providers. They also catalyse technology 
partnerships among various stake holders. 





V) 


Institutional and Managerial Issues: Institutions generating the data and 
managers are required to balance the need to restrict the use of data on secui..y 
considerations with civil society and scientific community requirements for the same 
data, generated at the cost of public funds. Non-sensitive data of limited spatial 
resolution and time legacies should be, made quickly available for wider use and 
permitted access to registered users. 

Financial Issues: Data generation and continuous updating do require financial support 
in the form of budgetary allocations or priced transactions. The policy framework should 
permit suitable financial support mechanisms either through budgetary support or 
rational pricing provisions. 

Legal Issues: National and International agreements directly affect the data-access and 
data-sharing practices. Copyright and I PR considerations may lead to certain 
restrictions. Security considerations preclude access and sharing of some kinds of data. 
However, denial of data access leads to denial of possible benefits arising from the use 
of the data. Therefore, data access could be provided to users based on stated 
purposes and the public good considerations. Registered users for certain types of data 
for legitimate and legally permitted use could be provided data access through a policy 

.framework. Since the purpose of use-becomes an important consideration in the data 

sharing and access policy, legal protections against the non- legitimate use would 
become necessary. 

Operational Issues: Nature of data, tools, technology infrastructure, structural and 
functional control over data and data use, standardization of data would raise a large 
number of operational issues while formulating data sharing and access policy, which 
have to be addressed. 

2. GUIDELINES FOR CLASSIFICATION OF DATA 

General principles for providing access and enabled sharing arise from the potentials for 
public and social good associated with such type of data which could be 
shared without compromise to national security, IPR and other confidentiality 
considerations. Classification of data therefore becomes necessary and a minimal 
negative list should be prepared by the data generators and sources. 

Data Sharing and Access policy shall apply to all non-classified data collected using 
public funds and held by various Ministries/Departments/Subordinate offices, etc. The 
Ministries/institutions/departments/sub ordinate offices etc generating and possessing 
data assets for sharing are hereafter referred to as organizations.. Organizations 
managing the data shall decide the classification as to whether it is sensitive or non¬ 
sensitive from the security standpoint. Thereafter a negative list may be drawn of 
sensitive data. All data outside the negative list will be put on website for information. 

For each data set, the format in which they are held, namely analog or digital, shall be 
identified. Effort should be to convert the analog data to digital form, if possible. This will 
enhance the portability of this data. Organizations shall prescribe procedures by which 
the access could be gained for specified and registered use. Organizations shall be free ( 
to fix a reasonable price for providing accessibility. All organizations managing data will ‘ 
classify the same as classified and non-classified. 
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Ministries/Departments of the Government of India shall be identified as a reference 
centre for mutual exchange for all organizations. The Ministries may evolve their own 
procedures for management and exchange the data managed by them. The 
administrative procedures should not be cumbersome so that the data transfer does not 
become time-consuming. The charges, if any to be levied should be decided by the 
concerned departments with a proviso that data costs do not become prohibitive for 
usage. 

Data users will have to follow the guidelines governing the acceptable and registered 
use of the data. Guidelines will be formulated and placed on the website of the data 
managing organization. 


3. CLIMATE CHANGE - A case study 

NAPCC has enunciated a total of eight missions. All these missions and other 
programmes in the context of the NAPCC would require extensive exchange and 
sharing of data among the agencies engaged in the implementation of mission-linked 
actions and other actions described in NAPCC. The concept of registered users could be 
developed and a suitable policy framework provided for data sharing. Under the current 
policy framework, ownership of data resides with the original generator. While sharing of 
data between one arm of the Government and another is permitted, the transfer of data 
by the receiving arm of the Government to a third arm is not allowed. Any value addition 
to primary data using service providers could be undertaken only within the premises of 
the owner department. The prevailing policy does not envisage value addition to primary 
data under public-private partnership using transaction or relationship models. It is 
important thai the revised data sharing policy takes into account data types, 
technological, managerial, institutional, financial, legal and operational issues mentioned 
above. 

A revenue sharing model to suit Data Sharing and Accessibility Policy without 
compromising to National security consideration is required. This would call for a 
consensus based approach for a collaborative excellence in developmental planning 
through innovative deployment of data generated with the use of public fund. 


4. SALIENT FEATURES 


• Indian data available globally should also be available to the Indian citizens. 

• The items excluded in the RTI Act will become part of the Negative List. 

• The RTI Act only stipulates that Government provides information in a reactive 
manner and there is no provision for public information in proactive manner. 
There is a need to strike a balance between developmental needs and the 
security. Similarly, there should be a balance between Right to Information and 
Right to Privacy. 

• RTI Act needs to be studied for the requirement of any explanatory notes. 
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8 Negative List will be prepared by each Organization/Department/Ministry/takinn 
into account the security, privacy, IPR etc. 

8 "^ e Negative List has to be constantly reviewed so that it is realistic and is in 

tune with the technology. 

* Policy should also not violate any existing laws such as IPR, Copy Right and 
proposed Privacy Law. 


5. GLOBAL SCENARIO 

USA launched their open data through their www.data.aov site which has now more than 

IHfh Sl ? ,, £ r ° Vlde data in 5 P roactive manner as apart of open government initiative. 

nen the U.S. government's data.gov site launched, critics pointed out that it was filled with 
relatively non-controversial data sets; plenty of USGS data but no Department of Justice or 
military data, for example. It has over U.S. site, Data.gov, has less than 1,000 data sets. A 
new website www.data.qov.uk, dedicated to making non-personal data held by the U.K. 
government was launched and has more than three times as much data than the U.S. 
site oners. At launch, data.gov.uk has nearly 3,000 data sets available for developers to 
build mashups with. The The UK government has been a big supporter of innovation built on 
top of public data. The U.K.'s data site also includes 22 military data sets at launch. Still they 
are grappling with the interoperability and standardized formats. The U.K. site does include 
a prominent promotion of the Semantic Web focusing on the paradigm as the next step for 
the future of the web. More standardized, structured daia is expected to be the direction that 
the program tries to get government agencies to move toward in the future. Canada is also 
actively pursuing 'Government 2.0' making data available at municipal, provincial and federal 
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OFFICE MEMORANDUM 


Subject:- National Policy for Data Sharing and Accessibility. 


Kindly find enclosed a copy of the Ministry of Science and 
Technology O.M. No.NRDMS/11/1431/2008 dated 14 th July 2010, on the subject 
mentioned above for information and necessary action. 

2. It is requested that the comments in the matter in respect of 

your division may kindly be sent to Ministry of Science and Tehcnology 
(NRDMS Division) within a period of three months under intimation of 
Coordination Section. 



(R.N. Singh) 

Under Secretary (Coordination) 
Tel. No,23095539 


Enel: As above 


Chairman, CBEC. 
Chairman, CBDT. 
Director General(CEIB). 
Director of Enforcement 
Director, FIU-IND 
Director(NC]f 
Director(HQrs) 
Director(Admin) 
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No.NRDMS/ 1 1/1431/200 g 
Government or India 
Ministry of Science & Technology 
Department of Science & Technology 
(NRDMS Division) j s 

Technology Bhavan. 
New Mehrauli Road. 
New Delhi. 1 1001 

Dated: the 14 th July 2 0 i 0 

OFFICE MEMOIR A NDTTMF 



Subject: 


National Policy for Data Sharing and Accessibility 






Lar 9 e volumes and different types of data are generated and compiled by various 

' or 9 anizations for meeting their specific requirements. Most 

madP null hi' n ? r T coilected at hu 9 e ^st, with the taxpayer's money could be 

imnrnvp thl tbe general pub,iC b V P |acin 9 it in the public domain for access to 

improve the country s economic growth and better planninq 

4 l..npTn° r 94 9 n y ’ t w e uT atte u r has been con sidered by the Cabinet in its meeting held 

.©'and Acdssibilitv' an Thp aS ^ t0 6V0lVe 3 ” Nationa! Poll 'cy for Data Sharing 

; n2r d o^ f b ty ' _, Th d pollcy would be evolved within the following broad 
parameters approved by the Government > 

fn h A? epa « ment ° f Sdence & Techn ology (DST) would be the nodal Department 
a - , anH ^w tter i. co " n ® cted Wlth overal1 coordination, formulation, implementation 

a d monitoring of the policy. Subject to this, each Ministry / Department of 

£ reStfno^o^hlt 0 ^ 4® tf ; e n nodal Department for implementation of the policy 

di/4 [pH * 9 4 th ? M ' nistry 1 Department as well as their autonomous / statutory 

7 7 bodies and sub-ordinate offices. y 

Inh4 P f°4 y Sha l' ? p , ply t0 al1 non -c |as sified / non-sensitive data coilected using 

4di4tp n ? h , e ' d by Van ' 0US Ministries 7 Departments (including their sub 
ordinate offices, and autonomous / statutory bodies) etc. 

W^of’p^nln!^ 5 x2f P ^ tn ?f nts of the G °vernment of India, would, within six months 
^ c °L apPr0Va ' 0f the Cab,net > classify their data into (a) sensitive, and (b) non- 
npcf ll| /e ’ ^ eepi , ng ! n Vlew the national security consideration. To the extent 
' Abased 6 ’ C ass,flcat,0n would be feature base d rather than geographical area 
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(iv; 


(v) 


(vi) 


(vii) 


(viii) 


(ix) 


(x) 


(xi) 


(xii) 


(xiii) 


A negative or an exclusion list would be drawn of the sensitive data ti e 
concerned Department. Ail data outside the Negative List would be put in the 
public domain. While drawing the negative or exclusion list, the Ministries / 
Departments would follow the broad guidelines delineated in the RTI Act 2005 
to ensure harmonious reading of the RTI Act with the proposed NPDSA. 


The negative list drayyn by the Ministries / Departments should be reviewed 
periodically (say after every 5 years) to see whether the data set should remain 
in the restricted category or not. 


While preparing the detailed policy framework, in consultation with various 
Ministries / Departments, DST would keep in mind the current international 
practices relating to management, processing and sharing of data, and latest 
technoldgy. 


For each data set, the format in which they are held viz. analogue or digital, shall 
be identified. Efforts would be made to convert the analogue data to digital 
format, to the extent possible, within a set time frame. 

The DST, in consultation with the Ministries / Departments managing data, 
would work out broad parameters for developing a pricing policy to ensure overall 
coherence. 

For data generated with the public funds from Government of India, Government 
should be considered the owner and data exchange amongst Ministries / 
Departments of Government should, generally, be at nominal charge, to be fixed 
by concerned Ministry / Department, keeping in view the cost of production of 
such data and broad guidelines to be fixed by DST. 

Ministries/Departments of the Government of India shall be identified as a 
reference centre for mutual exchange for all organizations. 

The Ministries / Departments may evolve their own procedures for management 
and exchange of data managed by them keeping in view the basic elements 
indicated by DST. However, administrative procedure should not be 
cumbersome so that the data transfer does not become time consuming. 

Within three months of in principle approval of Cabinet, the DST would share the 
basic elements for developing data policy with each Ministry / Department, who 
will, prepare its ‘detailed policy framework’ keeping in view the broad parameters 
approved by Cabinet and send it to DST within six months, based on which DST 
would prepare a detailed policy document on NPDSA and piace before Cabinet 
for final approval. 

For Geo-spatial data, existing National Spatial Data infrastructure (NSD1) 
mechanism involving both Department of Space and Department of Science & 
l echnology would be used for any conflict resolution. 


....3/- . 
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(xiv) The Ministries / Departments of Government of India shall, while releasing funds 
to State Governments / other institutions of State Government, including state 
and central universities, under different schemes / programmes put down a 
condition that data generated using such funds would be governed by this policy. 

3. DST would, keeping in view the ‘detailed policy framework’ prepared by various 
Ministries / Departments finalize the detailed policy document on National Policy for 
Data Sharing and Accessibility and place it before the Cabinet for final approval. 

4. Accordingly, all ministries / departments are requested to take necessary action 
to implement the above said decision of the Cabinet and pre pare a detailed policy 
framework on Data Sharing and Accessibility with regard to their ministries / 
■departments “(including their sub-ordinate offices, autonomous / statutory bodies, etc.) 
keeping in view with the broad parameters approved by the Cabinet and send it to DST 
within a period of three months to enable this Department to finalize the detailed policy 
document on National Policy for Data Sharing and Accessibility and place it before the 
Cabinet for final approval. 



(Dr Inder Jit Singh) 
Joint Secretary to the Government of india 


To: 


The Secretary 

All Ministries / Departments of Government of India 




